# Is it possible to parse and store a field as an array of objects in Elasticsearch?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-parse-and-store-a-field-as-an-array-of-objects-in-elasticsearch/148566>\
**Category:** Logstash\
**Created:** [September 14, 2018, 7:08am UTC](https://discuss.elastic.co/t/is-it-possible-to-parse-and-store-a-field-as-an-array-of-objects-in-elasticsearch/148566 "2018-09-14T07:08:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anra137](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@anra137](https://discuss.elastic.co/u/anra137)\
**Post date:** [September 14, 2018, 7:08am UTC](https://discuss.elastic.co/t/is-it-possible-to-parse-and-store-a-field-as-an-array-of-objects-in-elasticsearch/148566/1 "2018-09-14T07:08:46Z")

</div>

My logline would look like this

`2018-03-09 16:12:20,315 INFO [com.sample.teste.TestClass] (https-express.sample.com-433-8) {my-name-1=my-value-1, my-name-2=my-value-2} Testing logger`

And I have pipeline config as

```
filter {
    grok {
             match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} *\[%{JAVACLASS:logger}\] \(%{GREEDYDATA:thread}\) \{%{GREEDYDATA:mdc}\} %{GREEDYDATA:message}"}
        overwrite => ["message"]
        }
    mutate {
        split => { "mdc" => "," }
    }
}

```

And the output of that field in elasticsearch is

```
"mdc": [
      "my-name-1=my-value-1",
      " my-name-2=my-value-2"
    ],

```

Is it possible to parse and store this field as an array of objects instead? Like this

```
  "mdc": [
    {
        "name": "my-name-1",
        "value": "my-value-1"
    },
    {
        "name": "my-name-2",
        "value": "my-value-2"
    }
]
```

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [September 17, 2018, 1:28am UTC](https://discuss.elastic.co/t/is-it-possible-to-parse-and-store-a-field-as-an-array-of-objects-in-elasticsearch/148566/2 "2018-09-17T01:28:10Z")

</div>

Yes, but you'll need to specify the [Nested](https://www.elastic.co/guide/en/elasticsearch/reference/current/nested.html) type in your index mapping (or mapping template) _before_ the index is allowed to auto-create the fields in an index.

---

<div class="post-metadata">

**Author:** ![anra137](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@anra137](https://discuss.elastic.co/u/anra137)\
**Post date:** [September 18, 2018, 7:54am UTC](https://discuss.elastic.co/t/is-it-possible-to-parse-and-store-a-field-as-an-array-of-objects-in-elasticsearch/148566/3 "2018-09-18T07:54:03Z")

</div>

Thanks for your time @yaauie. I will try this and get back.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2018, 7:54am UTC](https://discuss.elastic.co/t/is-it-possible-to-parse-and-store-a-field-as-an-array-of-objects-in-elasticsearch/148566/4 "2018-10-16T07:54:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.