# Multi nested documents in logstash aggregation

**URL:** https://discuss.elastic.co/t/multi-nested-documents-in-logstash-aggregation/107597
**Category:** Logstash
**Created:** [November 14, 2017, 5:14pm UTC](https://discuss.elastic.co/t/multi-nested-documents-in-logstash-aggregation/107597 "2017-11-14T17:14:20Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ahmadhattab](https://avatars.discourse-cdn.com/v4/letter/a/34f0e0/32.png) [@ahmadhattab](https://discuss.elastic.co/u/ahmadhattab)
#### Post date: [November 14, 2017, 5:14pm UTC](https://discuss.elastic.co/t/multi-nested-documents-in-logstash-aggregation/107597/1 "2017-11-14T17:14:20Z")

</div>

Hello,

I have 3 tables:

- users
- posts
- comments

I made a left join query to get users then posts then comments like this:

SELECT [users.id](http://users.id) as user\_id, [users.name](http://users.name) as user\_name, [posts.id](http://posts.id) as post\_id, posts.title as post\_title, posts.user\_id as post\_user\_id, [comments.id](http://comments.id) as comment\_id, comments.post\_id as comment\_post\_id, comments.comment as comment\_title FROM `users` LEFT JOIN posts on [users.id](http://users.id) = posts.user\_id LEFT JOIN comments on [posts.id](http://posts.id) = comments.post\_id

And i made aggregation the goal from it to have document like this

{  
user\_id : 1,  
user\_name: jake  
posts: [  
{  
post\_id: 1  
comments: [  
{  
comment\_id: 2  
}  
{comment\_id: 3  
}  
]  
}  
]  
}

And this is my aggregation:  
filter {

mutate {  
rename =\> {  
"post\_id" =\> "[posts][post\_id]"  
"post\_title" =\> "[posts][post\_title]"  
"post\_user\_id" =\> "[posts][post\_user\_id]"  
"comment\_id" =\> "[posts][comments][comment\_id]"  
"comment\_title" =\> "[posts][comments][comment\_title]"  
"comment\_post\_id" =\> "[posts][comments][comment\_post\_id]"  
}  
}

aggregate {  
task\_id =\> "%{user\_id}"  
code =\> "  
map['posts'] ||= []

event.to\_hash.each do |key,value|  
map[key] = value unless map.has\_key?(key)  
map[key] \<\< value if map[key].is\_a?(Array)  
end  
"  
push\_previous\_map\_as\_event =\> true  
}

aggregate {  
task\_id =\> "%{post\_id}"  
code =\> "  
map['posts']['comments'] ||= [{}]  
event.to\_hash.each do |key,value|  
map[key] = value unless map.has\_key?(key)  
map[key] \<\< value if map[key].is\_a?(Array)

end  
"  
push\_previous\_map\_as\_event =\> true  
}

}

But i got a repeated post documents as the number of related comments for the same post

Do you have any suggestion or solution for this issue ?

Thanks

---

<div class="post-metadata">

### Author: ![ahmadhattab](https://avatars.discourse-cdn.com/v4/letter/a/34f0e0/32.png) [@ahmadhattab](https://discuss.elastic.co/u/ahmadhattab)
#### Post date: [November 16, 2017, 8:56am UTC](https://discuss.elastic.co/t/multi-nested-documents-in-logstash-aggregation/107597/2 "2017-11-16T08:56:55Z")

</div>

Any update?

---

<div class="post-metadata">

### Author: ![debug29](https://avatars.discourse-cdn.com/v4/letter/d/b487fb/32.png) [@debug29](https://discuss.elastic.co/u/debug29)
#### Post date: [December 12, 2017, 11:34am UTC](https://discuss.elastic.co/t/multi-nested-documents-in-logstash-aggregation/107597/3 "2017-12-12T11:34:20Z")

</div>

Got the same problem, is someone found a solution ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 9, 2018, 11:34am UTC](https://discuss.elastic.co/t/multi-nested-documents-in-logstash-aggregation/107597/4 "2018-01-09T11:34:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.