I have 3 tables : user, post, comment are joined with left join. I created a nested object (posts) for each user. I'm able to aggregate the posts object but i want also to aggregate the comments object inside each posts ,it gives me each comment in separated object while more than one comments are having the same post id, i want to combine all post comments in one array. This is my filter :
filter {
mutate {
rename => {
"post_id" => "[posts][post_id]"
"post_user" => "[posts][post_user]"
"comment_id" => "[posts][comments][comment_id]"
"comment_post" => "[posts][comments][comment_post]"
}
}
aggregate {
task_id => "%{user_id}"
code => "
map['posts'] ||= []
"
push_previous_map_as_event => true
}
aggregate {
task_id => "%{[posts][post_id]}"
code => "
map['posts']['comments'] ||= []
"
push_previous_map_as_event => true
}
}
This is the result :
{
'user_id' : 2,
'name' : 'farah',
'posts' :
[
{
'post_id' : 1,
'post_user' : 2,
'comments':
{
'comment_id' : 1,
'comment_post':1
}
},
{
'post_id' : 1,
'post_user' : 2,
'comments':
{
'comment_id' : 2,
'comment_post':1
}
},
'post_id' : 3,
'post_user' : 2,
}
]
}