# Map embedded json object to one field

**URL:** <https://discuss.elastic.co/t/map-embedded-json-object-to-one-field/225667>\
**Category:** Elasticsearch\
**Created:** [March 30, 2020, 11:41am UTC](https://discuss.elastic.co/t/map-embedded-json-object-to-one-field/225667 "2020-03-30T11:41:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cowensel](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@cowensel](https://discuss.elastic.co/u/cowensel)\
**Post date:** [March 30, 2020, 11:41am UTC](https://discuss.elastic.co/t/map-embedded-json-object-to-one-field/225667/1 "2020-03-30T11:41:26Z")

</div>

I can see there a number of posts about this but I cannot seem to make heads or tails of them.

We have some logs that get sent to our ELK server where an embedded Json object is sent. I would like to map everything in the embedded Json object to appear in the field Json object. Granted this is not the full template but we have the following:

> ```
> > "JSONObject" : {
> > "properties" : {
> > "Capacity" : {
> > "type" : "long"
> > },
> > "Id" : {
> > "type" : "long"
> > },
> > "m_MaxCapacity" : {
> > "type" : "long"
> > },
> > "m_StringValue" : {
> > "norms" : false,
> > "type" : "text",
> > "fields" : {
> > "keyword" : {
> > "ignore_above" : 256,
> > "type" : "keyword"
> > }
> > }
> > },
> > "m_currentThread" : {
> > "type" : "long"
> > }
> > }
> > },
> 
> ```

This does not seem to work and it splits each field which is causing a large number of fields to be added. The field names do not match.  
Can someone advise the best way to do this? It will be much appreciated.

---

<div class="post-metadata">

**Author:** ![cowensel](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@cowensel](https://discuss.elastic.co/u/cowensel)\
**Post date:** [March 30, 2020, 2:49pm UTC](https://discuss.elastic.co/t/map-embedded-json-object-to-one-field/225667/2 "2020-03-30T14:49:32Z")

</div>

To ensure the contents of Jsonobject stays in the same field do I need to update the template to be:

> PUT /\_templates/logstash  
> {  
> "mappings": {  
> "properties": {  
> "JSONObject": { "type": "nested" }  
> }  
> }  
> }

Or would that cause any issues?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2020, 2:49pm UTC](https://discuss.elastic.co/t/map-embedded-json-object-to-one-field/225667/3 "2020-04-27T14:49:42Z")

</div>

Closed on April 27, 2020, 2:49pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.