# Logstash Extract Elasticsearch Nested Fields

**URL:** <https://discuss.elastic.co/t/logstash-extract-elasticsearch-nested-fields/275451>\
**Category:** Logstash\
**Created:** [June 9, 2021, 2:17pm UTC](https://discuss.elastic.co/t/logstash-extract-elasticsearch-nested-fields/275451 "2021-06-09T14:17:28Z")\
**Posts on this page:** 1\
**Showing post:** 19

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 16, 2021, 3:04am UTC](https://discuss.elastic.co/t/logstash-extract-elasticsearch-nested-fields/275451/19 "2021-06-16T03:04:20Z")

</div>

I do not know what to say. Both the mutate+add\_field and the csv output will event.get "[appEvents][0][attribute\_num][filesPendingForUpload]". If that field exists it should be expanded.

Are you getting this for every event?

---

_[View the full topic](https://discuss.elastic.co/t/logstash-extract-elasticsearch-nested-fields/275451)._