# Logstash query multiple documents from time series indices and output to a single nested elasticsearch document

**URL:** https://discuss.elastic.co/t/logstash-query-multiple-documents-from-time-series-indices-and-output-to-a-single-nested-elasticsearch-document/192543
**Category:** Logstash
**Created:** [July 27, 2019, 11:25pm UTC](https://discuss.elastic.co/t/logstash-query-multiple-documents-from-time-series-indices-and-output-to-a-single-nested-elasticsearch-document/192543 "2019-07-27T23:25:44Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![jdcohen220](https://avatars.discourse-cdn.com/v4/letter/j/e68b1a/32.png) [@jdcohen220](https://discuss.elastic.co/u/jdcohen220)
#### Post date: [July 27, 2019, 11:25pm UTC](https://discuss.elastic.co/t/logstash-query-multiple-documents-from-time-series-indices-and-output-to-a-single-nested-elasticsearch-document/192543/1 "2019-07-27T23:25:44Z")

</div>

Hi,

New to logstash and wondering if it is possible for the following use case. Doing some searching it is not entirely clear if it is possible to query elasticsearch in filter stage for **multiple documents** and **nest into a single output document**. This is what we are hoping to accomplish.

Input:  
Kafka event with a particular term.

Filter:  
Query time series indices for multiple documents containing that term, within the date range. (Our indices are named index\_2019-07-28, index\_2019-07-29....

Output:  
Index a single elasticsearch document in a "rollup" index that nests the documents returned in the filter stage within a single nested field of the output document.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 24, 2019, 11:25pm UTC](https://discuss.elastic.co/t/logstash-query-multiple-documents-from-time-series-indices-and-output-to-a-single-nested-elasticsearch-document/192543/2 "2019-08-24T23:25:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
