# Index nested json

**URL:** https://discuss.elastic.co/t/index-nested-json/127854
**Category:** Logstash
**Created:** [April 12, 2018, 5:05pm UTC](https://discuss.elastic.co/t/index-nested-json/127854 "2018-04-12T17:05:49Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![chrigui94](https://avatars.discourse-cdn.com/v4/letter/c/a8b319/32.png) [@chrigui94](https://discuss.elastic.co/u/chrigui94)
#### Post date: [April 12, 2018, 5:05pm UTC](https://discuss.elastic.co/t/index-nested-json/127854/1 "2018-04-12T17:05:50Z")

</div>

I have a nested file each document is like the following (contains a field "gateways" contains diffents number of gateways each one contains a latitude and longitude)  
{  
field1: "aa",  
field2:"bb",  
"gateways"[  
{antennaLatitude:1222, antennaLongitude:1555},  
{antennaLatitude:222, antennaLongitude:444}  
]  
}  
First step I set my template which is like this 🙂  
\> {

> ```
> "template" : "logstash-*",
> "version" : 50001,
> "settings" : {
> "index.refresh_interval" : "5s",
> "index.mapping.ignore_malformed": true
> },
> "mappings" : {
> "_default_" : {
> "_all" : {"enabled" : true, "norms" : false},
> "dynamic_templates" : [ {
> "message_field" : {
> "path_match" : "message",
> "match_mapping_type" : "string",
> "mapping" : {
> "type" : "text",
> "norms" : false
> }
> }
> }, {
> "string_fields" : {
> "match" : "*",
> "match_mapping_type" : "string",
> "mapping" : {
> "type" : "text", "norms" : false,
> "fields" : {
> "keyword" : { "type": "keyword", "ignore_above": 256 }
> }
> }
> }
> } ],
> "properties" : {
> "@timestamp": { "type": "date", "include_in_all": false },
> "@version": { "type": "keyword", "include_in_all": false },
> "geoip" : {
> "type" : "geo_point" 
> },
> "geoip_Dev": {
> "type" : "geo_point" 
> },
> "geoip_gwy": {
> "type" : "geo_point" 
> },
> "gtwys":{ 
> "type": "nested",
> "properties": {
> "antennaLatitude":{"type":"keyword"},
> "antennaLongitude":{"type":"keyword"},
> "position": {"type": "geo_point"}
> }
> }
> }
> }
> }
> }
> 
> ```

But I dont know how to index these nested json in logstash to correspond my template:  
to produce 2 geo\_point positions ?

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [April 12, 2018, 5:20pm UTC](https://discuss.elastic.co/t/index-nested-json/127854/2 "2018-04-12T17:20:24Z")

</div>

I think you have to rename fields to `lat` and `lon` and then declare `gateways` as a `geo_point`. That might work.

---

<div class="post-metadata">

### Author: ![chrigui94](https://avatars.discourse-cdn.com/v4/letter/c/a8b319/32.png) [@chrigui94](https://discuss.elastic.co/u/chrigui94)
#### Post date: [April 13, 2018, 8:16am UTC](https://discuss.elastic.co/t/index-nested-json/127854/3 "2018-04-13T08:16:58Z")

</div>

I need how to do this in logstash conf file (how to assign fields correctly ) ?  
I did {  
mutate {  
add\_field =\> ["[gtwys][position][lat]", "%{[gateways][antennaLatitude]}" ]  
add\_field =\> ["[gtwys][position][lon]", "%{[gateways][antennaLongitude]}" ]  
}  
mutate {  
convert =\> {"[gtwys][position]" =\> "float"}  
}  
}  
If I do that my document after indexing looks like:

 ![gtw](https://us1.discourse-cdn.com/elastic/original/3X/b/b/bb6482a4a07fbe5a77b9b9dfee0fc65cffe78ea8.PNG)

as explained in the figure I need to put these coordinates in the new nested field created (gtwys.position) in order to show them on the map on kibana ?

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [April 13, 2018, 8:32am UTC](https://discuss.elastic.co/t/index-nested-json/127854/4 "2018-04-13T08:32:08Z")

</div>

I moved your question to #logstash then.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 11, 2018, 8:32am UTC](https://discuss.elastic.co/t/index-nested-json/127854/5 "2018-05-11T08:32:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.