# Logstash nested data update is not working as expected

**URL:** https://discuss.elastic.co/t/logstash-nested-data-update-is-not-working-as-expected/214965
**Category:** Logstash
**Created:** [January 14, 2020, 9:27am UTC](https://discuss.elastic.co/t/logstash-nested-data-update-is-not-working-as-expected/214965 "2020-01-14T09:27:17Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Ram\_29](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ram_29/32/47522_2.png) [@Ram\_29](https://discuss.elastic.co/u/Ram_29)
#### Post date: [January 14, 2020, 9:27am UTC](https://discuss.elastic.co/t/logstash-nested-data-update-is-not-working-as-expected/214965/1 "2020-01-14T09:27:17Z")

</div>

Hi

I'm having a nested field as below

"appdata": {  
"type":"nested",  
"include\_in\_parent":true,  
"properties": {  
"accessType": {  
"type": "text",  
"norms": false,  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"appname": {  
"type": "text",  
"norms": false,  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"eventtime": {  
"type": "text",  
"norms": false,  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
}  
}  
}

I'm updating the same using logstash in output plugin as below

elasticsearch  
{  
hosts =\> ["localhost:9200"]  
document\_id =\> "%{sid}"  
index =\> "dashboard\_write"  
timeout =\> 30  
script =\> "if (ctx.\_source.appdata == null) { ctx.\_source.appdata = params.event.get('appdata') } else { ctx.\_source.appdata = ctx.\_source.appdata + params.event.get('appdata') }"  
doc\_as\_upsert =\> true  
action =\> "update"  
}

First time appdata will be null and it should assign that value. For second event, it should append the data to existing appdata  
But I saw ctx.\_source.appdata is empty even though data is there

Am I doing anything wrong here

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 11, 2020, 9:27am UTC](https://discuss.elastic.co/t/logstash-nested-data-update-is-not-working-as-expected/214965/2 "2020-02-11T09:27:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.