# Need to promote nested field to a higherlevel using logstash

**URL:** <https://discuss.elastic.co/t/need-to-promote-nested-field-to-a-higherlevel-using-logstash/34292>\
**Category:** Logstash\
**Created:** [November 11, 2015, 1:13am UTC](https://discuss.elastic.co/t/need-to-promote-nested-field-to-a-higherlevel-using-logstash/34292 "2015-11-11T01:13:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ramdev\_Wudali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramdev_wudali/32/7894_2.png) [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\
**Post date:** [November 11, 2015, 1:13am UTC](https://discuss.elastic.co/t/need-to-promote-nested-field-to-a-higherlevel-using-logstash/34292/1 "2015-11-11T01:13:05Z")

</div>

Hi:  
I have a mapping similar to this :

```
{
       "type1" : {
           "properties" : {
               "field1": {
                  "type": "nested",
                  "nested_field1": {
                     "type": "string"
                  },
                  "nested_field2": {
                    "type": "nested",
                    "properties": {
                       "sub_nested_field1" : {
                          "type" : "string"
                       }
                    }
                  }
            }
            }
            }
            }

```

I want to flatten out the document so that the mapping looks like so :

```
    {
       "type1" : {
           "properties" : {
               "field1": {
                  "type": "nested",
                  "nested_field1": {
                     "type": "string"
                  },
                  "sub_nested_field1" : {
                          "type" : "string"
                       }
    
            }
            }
            }
            }

```

I am using logstash to copy the data from one ES index to another. However, I have not been very successful at translating the required mapping.

```
input {
   elasticsearch {
     hosts => ["localhost"]
     port => "9200"
     index => "index1"
     scroll => "5m"
     docinfo => true
   }
}

filter {
  mutate {
        rename => {"field1" => "field1_old"}
    add_field => {
        "[field1_old][sub_nested_field1]" => "[entities_old][nested_field2][sub_nested_field1]"
    }
        remove_field => ["@timestamp","@version","[field1_old][nested_field2]"]
  }
}

output {
   elasticsearch {
     host => "localhost"
     port => 9300
     protocol => "transport"
     index => "index2"
     document_type => "type1"
     document_id => "%{[@metadata][_id]}"
   }
   stdout {
     codec => "dots"
   }
}

```

However I am having difficulty with this mapping. its not giving me he result I am expecting.. any help is much appreciated.

---

<div class="post-metadata">

**Author:** ![Architha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/architha/32/92477_2.png) [@Architha](https://discuss.elastic.co/u/Architha)\
**Post date:** [February 16, 2016, 7:35am UTC](https://discuss.elastic.co/t/need-to-promote-nested-field-to-a-higherlevel-using-logstash/34292/2 "2016-02-16T07:35:31Z")

</div>

@Ramdev_Wudali

Hi, have you solved this issue ? I am facing a similar situation.  
Kindly revert if you have a solution . Thanks!

---

<div class="post-metadata">

**Author:** ![Ramdev\_Wudali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramdev_wudali/32/7894_2.png) [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\
**Post date:** [February 16, 2016, 12:41pm UTC](https://discuss.elastic.co/t/need-to-promote-nested-field-to-a-higherlevel-using-logstash/34292/3 "2016-02-16T12:41:26Z")

</div>

Hi:  
I had to skip solving this problem as the mapping/flattening would not have worked out for me and so I did not pursue this any further.

Ramdev

---

<div class="post-metadata">

**Author:** ![Architha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/architha/32/92477_2.png) [@Architha](https://discuss.elastic.co/u/Architha)\
**Post date:** [February 18, 2016, 9:39am UTC](https://discuss.elastic.co/t/need-to-promote-nested-field-to-a-higherlevel-using-logstash/34292/4 "2016-02-18T09:39:57Z")

</div>

Okay 😥  
Thanks for the reply !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/need-to-promote-nested-field-to-a-higherlevel-using-logstash/34292/5 "2017-07-06T05:10:54Z")

</div>

Closed on July 6, 2017, 5:10am UTC