# Elasticsearch/kibana mapping multi-layered/nested data

**URL:** <https://discuss.elastic.co/t/elasticsearch-kibana-mapping-multi-layered-nested-data/272821>\
**Category:** Elasticsearch\
**Created:** [May 12, 2021, 2:49pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-mapping-multi-layered-nested-data/272821 "2021-05-12T14:49:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stcdarrell](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\
**Post date:** [May 12, 2021, 2:49pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-mapping-multi-layered-nested-data/272821/1 "2021-05-12T14:49:01Z")

</div>

hi,  
i'm having some issues wrapping my head around how to map this data in elasticsearch/kibana:  
I'm pulling query data from [VirusTotal.com](http://VirusTotal.com)'s API on malware. here is a SMALL portion of a HUGE chunk of the query:

(1)  
VirusTotal.data.attributes.popular\_threat\_classification.popular\_threat\_category  
{  
"count": 22,  
"value": "trojan"  
},  
{  
"count": 13,  
"value": "ransomware"  
}   
VirusTotal.data.attributes.popular\_threat\_classification.popular\_threat\_name  
{  
"count": 9,  
"value": "wanna"  
},  
{  
"count": 7,  
"value": "wannacry"  
},  
{  
"count": 4,  
"value": "cztf"  
}

how would i map this ?  
VirusTotal.data.attributes.popular\_threat\_classification.popular\_threat\_name  
VirusTotal: Object?  
--- data: Object?  
------- attributes: Object?  
---------- popular\_threat\_classification: object  
---------------- popular\_threat\_name: nested?  
------------------------- count: numberic:integer?  
------------------------- value: string  
---------------- popular\_threat\_category: nested?  
------------------------- count: numberic:integer?  
------------------------- value: string

(2) i also have a set of fields like this:  
av\_names:  
['Trojan.AndroidOS.Coinminer', 'Win.Trojan.Agent-6732758-0', 'Trojan.Coinminer.Android.41', 'ANDROID/Coinminer.gcmuy', 'ELF:BitCoinMiner-FZ [PUP]', 'AppRisk:Generisk', 'ELF/Trojan.KVRC-7', 'Android.CoinMine.55', 'Malware.ANDROID/Coinminer.gcmuy', 'Trojan.Linux.Coinmine.4!c', 'Linux/Coinminer.153208', 'Android/Coinminer.X', 'RDN/Generic.dx', 'ELF/AdbMiner.X!tr', 'Mal/Generic-S', 'Win32/Virus.44a', 'Trojan.ElfArm32.CoinMine.fkgpcg', 'Coinminer\_MALXMR.B-ELF32']

this is essentially an array/list of "tags", what is the proper way to label/identify it as a list of tags?

any suggestions would be appreciated

---

<div class="post-metadata">

**Author:** ![stcdarrell](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\
**Post date:** [May 21, 2021, 12:21am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-mapping-multi-layered-nested-data/272821/2 "2021-05-21T00:21:32Z")

</div>

I ended up just cleaning up the data in python before submitting to ES.

basically turned every array that was in the response into a python string.. removed the "[" and "]", then used the python split command to split the string up by commas into a python List.

after I did that, everything went into ES just fine.

I used a mix of elasticsearch objects, nested, and flattened to map things correctly.

I hope this helps

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 18, 2021, 12:21am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-mapping-multi-layered-nested-data/272821/3 "2021-06-18T00:21:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.