# Flatten nested dictionaries in index

**URL:** <https://discuss.elastic.co/t/flatten-nested-dictionaries-in-index/216711>\
**Category:** Elasticsearch\
**Created:** [January 27, 2020, 6:41pm UTC](https://discuss.elastic.co/t/flatten-nested-dictionaries-in-index/216711 "2020-01-27T18:41:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ellisvalentiner](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@ellisvalentiner](https://discuss.elastic.co/u/ellisvalentiner)\
**Post date:** [January 27, 2020, 6:41pm UTC](https://discuss.elastic.co/t/flatten-nested-dictionaries-in-index/216711/1 "2020-01-27T18:41:42Z")

</div>

I'm new to these forums so please let me know if I've posted this in the wrong place.

I have an index that contains a key-value `tags` consisting of an array of values, which are dictionaries. The dictionaries always have 3 keys, `key`, `type`, and `value.

Example document:

```
{
  "tags": [
    {
      "key": "http.status_code",
      "type": "string",
      "value": "200"
    },
    {
      "key": "http.protocol",
      "type": "string",
      "value": "HTTP/1.1"
    }
  ]
}

```

However what I'd really like is to flatten the nested dictionaries so they were top-level key-values in the document using the corresponding key and value, like this:

```
{
  "http.status_code": "200",
  "http.protocol": "HTTP/1.1"
}

```

Unfortunately I'm having a difficult time understanding how to accomplish this.

Should `tags` be a nested type in the index? Can I use scripted fields to accomplish this?

---

<div class="post-metadata">

**Author:** ![linkerc](https://avatars.discourse-cdn.com/v4/letter/l/13edae/32.png) [@linkerc](https://discuss.elastic.co/u/linkerc)\
**Post date:** [January 27, 2020, 10:32pm UTC](https://discuss.elastic.co/t/flatten-nested-dictionaries-in-index/216711/2 "2020-01-27T22:32:07Z")

</div>

"Nest" has a meaning in ES.  
By default, all fields are not nested. It just adds a name space to your key.  
So in your case, every object under "tags" is searched equally.

In your example, you just need to use "tags.http.status\_code".  
If you really want top level, you have to store each object as individual document.  
Basically removing the layer "tags", which eliminates the arraylist (tags).

---

<div class="post-metadata">

**Author:** ![ellisvalentiner](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@ellisvalentiner](https://discuss.elastic.co/u/ellisvalentiner)\
**Post date:** [January 28, 2020, 3:08am UTC](https://discuss.elastic.co/t/flatten-nested-dictionaries-in-index/216711/3 "2020-01-28T03:08:21Z")

</div>

Hm. I'm not sure how to use `tags.http.status_code` as a top level key in the index given that that is the value of `key` in one of the dictionaries.

But I did find that I can use scripted fields to extract information:

```
for (def tag : params['_source']['tags']) {
  if (tag['key'] == 'http.status_code') {
    return tag['value']
  }
}

```

Unfortunately I have to set this up manually for every possible key-value dictionary.

---

<div class="post-metadata">

**Author:** ![linkerc](https://avatars.discourse-cdn.com/v4/letter/l/13edae/32.png) [@linkerc](https://discuss.elastic.co/u/linkerc)\
**Post date:** [January 28, 2020, 7:54pm UTC](https://discuss.elastic.co/t/flatten-nested-dictionaries-in-index/216711/4 "2020-01-28T19:54:21Z")

</div>

Sorry, I mean to say "tags.key". I copy and pasted from the wrong source.

if "http.status\_code" & "http.protocol" is what you want, you need to store in such structure in your document.

```
{
  "http": {
    "status_cude": "200",
    "protocol": "HTTP/1.1"
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2020, 8:02pm UTC](https://discuss.elastic.co/t/flatten-nested-dictionaries-in-index/216711/5 "2020-02-25T20:02:29Z")

</div>

Closed on February 25, 2020, 8:02pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.