How to extract nested json objects in to new fields in kibana

[sandhya1 (Sandhhya)]

Hi,
I have one field which is having nested j son object format, i need to extract into new fields. The field is mapped to the "text" data type and from the below format i need the count of unique first name and need to retrieve all the first name.

{Names:[{“first name”: ”A”,”id”:[{‘first id’:””,”Second id”:}],
{“first name”:”B”,”id”:[{‘first id’:””,”Second id”:}]}],
Status:”ABC”}

Please help me out ,how can i able to get the count from nested j son object.

Thanks in Advance,
Sandhya

[tsullivan (Tim Sullivan)]

Hi, if the data is mapped as text in Elasticsearch, then Kibana will only be able to do text-based operations on it. It sounds like the data should be indexed as data, not text.

Also, the data sample you gave is not parseable as JSON, so it's super hard to make a mental picture of what you are dealing with. I recommend using the formatting tools to format the data snippets into code and provide a structure that is actually parseable JSON or formatted in a way that makes the structure clear.

[ghudgins (Graham Hudgins)]

you could maybe try a runtime field for this (if you're in 7.13+ the "add field" button is in the field list in lens & discover)

here's an example that extracts price

// Flatten a nested field 
// Document looks like:
// {
//  "products": [ <-- nested field
//    { "title": "Kibana", "price": 42.02 },
//    { "title": "Elasticsearch", "price": 22.10 }
//  ]
// }

for (def product : params._source.products) {
    emit(product.price);
}