# Logstash update nested data
**URL:** https://discuss.elastic.co/t/logstash-update-nested-data/211622
**Category:** Logstash
**Created:** [December 12, 2019, 10:50am UTC](https://discuss.elastic.co/t/logstash-update-nested-data/211622 "2019-12-12T10:50:02Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Ram\_29](https://discuss.elastic.co/u/Ram_29)
#### Post date: [December 12, 2019, 10:50am UTC](https://discuss.elastic.co/t/logstash-update-nested-data/211622/1 "2019-12-12T10:50:02Z")
Hi
I'm having a nested field as below
"appdata": {
"type":"nested",
"include\_in\_parent":true,
"properties": {
"accessType": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore\_above": 256
}
}
},
"appname": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore\_above": 256
}
}
},
"eventtime": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore\_above": 256
}
}
}
}
}
I'm updating the same using logstash in output plugin as below
elasticsearch
{
hosts =\> ["localhost:9200"]
document\_id =\> "%{sid}"
index =\> "dashboard\_write"
timeout =\> 30
script =\> "if (ctx.\_source.appdata == null) { ctx.\_source.appdata = params.event.get('appdata') } else { ctx.\_source.appdata = ctx.\_source.appdata + params.event.get('appdata') }"
doc\_as\_upsert =\> true
action =\> "update"
}
First time appdata will be null and it should assign that value. For second event, it should append the data to existing appdata
But I saw ctx.\_source.appdata is empty even though data is there
Am I doing anything wrong here
---
### Author:  [@Ram\_29](https://discuss.elastic.co/u/Ram_29)
#### Post date: [December 13, 2019, 6:33am UTC](https://discuss.elastic.co/t/logstash-update-nested-data/211622/2 "2019-12-13T06:33:39Z")
After removing timeout in above output plugin, I'm able to cross half way. Now its going to else and try to append the data and tells below error
Cannot apply [+] operation to types [java.util.LinkedHashMap] and [java.util.HashMap]
I even tried add instead of +, but that tells "Add method is not there in LinkedHashMap".
If I use
ctx.\_source.appdata.put('appdata',params.event.get('appdata')), its overwrites existing data instead of appending
Why nested object is being considered as LinkedHashMap??
---
### Author:  [@Ram\_29](https://discuss.elastic.co/u/Ram_29)
#### Post date: [December 16, 2019, 5:20am UTC](https://discuss.elastic.co/t/logstash-update-nested-data/211622/3 "2019-12-16T05:20:10Z")
Can some one please provide an update??
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 13, 2020, 5:31am UTC](https://discuss.elastic.co/t/logstash-update-nested-data/211622/4 "2020-01-13T05:31:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.