# How to create a parent using the new join type with logstash

**URL:** https://discuss.elastic.co/t/how-to-create-a-parent-using-the-new-join-type-with-logstash/119523
**Category:** Logstash
**Created:** [February 12, 2018, 5:34pm UTC](https://discuss.elastic.co/t/how-to-create-a-parent-using-the-new-join-type-with-logstash/119523 "2018-02-12T17:34:25Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![mmoxam](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mmoxam](https://discuss.elastic.co/u/mmoxam)
#### Post date: [February 12, 2018, 5:34pm UTC](https://discuss.elastic.co/t/how-to-create-a-parent-using-the-new-join-type-with-logstash/119523/1 "2018-02-12T17:34:25Z")

</div>

With the introduction of the new join datatype, parent child relationships have been updated to a new format. How can I use Logstash to specify the field that will be used as the join between the parent and the child.

Docuemntation: [https://www.elastic.co/guide/en/elasticsearch/reference/current/parent-join.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/parent-join.html)

I also see that the Elastic Search output plugin has a parent field that will allow me to set the parent for the child but how do I setup the mapping to begin with using Logstash?

---

<div class="post-metadata">

### Author: ![mmoxam](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mmoxam](https://discuss.elastic.co/u/mmoxam)
#### Post date: [February 21, 2018, 3:29pm UTC](https://discuss.elastic.co/t/how-to-create-a-parent-using-the-new-join-type-with-logstash/119523/2 "2018-02-21T15:29:31Z")

</div>

I figured it out:

First setup your mapping to create the join field.:  
_(Not sure how to do this straight from logstash. If someone else does please let me know.)_

```
PUT logstash-index-name
{
  "mappings": {
    "doc": {
      "properties": {
        "join_field": { 
          "type": "join",
          "relations": {
            "customer": "actions"
          }
        }
      }
    }
  }
}

```

You can add a parent via Logstash with:

```
mutate {
	add_field => { "join_field" => "customer" }			
}

```

And you can add a child like this:

```
mutate {
	add_field => {"[join_field][name]" => "actions"}
	add_field => {"[join_field][parent]" => "%{parent_id}"}
}

```

You also need to add the routing id in the Logstash output Elastic Search plugin:

```
if [type] == "child_actions" {		
	elasticsearch {
		hosts => ["localhost:9200"]
		index => "logstash-index-name"
		routing => "%{parent_id}"
	}		
}

```

All child documents will now have the "join\_field" as a nested field.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 21, 2018, 3:29pm UTC](https://discuss.elastic.co/t/how-to-create-a-parent-using-the-new-join-type-with-logstash/119523/3 "2018-03-21T15:29:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
