# Nested indexing possible?

**URL:** <https://discuss.elastic.co/t/nested-indexing-possible/228584>\
**Category:** Logstash\
**Created:** [April 17, 2020, 9:21pm UTC](https://discuss.elastic.co/t/nested-indexing-possible/228584 "2020-04-17T21:21:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![EliWallic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eliwallic/32/66544_2.png) [@EliWallic](https://discuss.elastic.co/u/EliWallic)\
**Post date:** [April 17, 2020, 9:21pm UTC](https://discuss.elastic.co/t/nested-indexing-possible/228584/1 "2020-04-17T21:21:03Z")

</div>

Hi all,

I have some plaintext logfiles which i want to have in a single event. For example:

Start time: 20200417225004  
property1: value1  
property2: value2  
property3: value3  
property4: value4  
Command start time: 20200417225016  
property1: value1  
property2: value2  
Command start time: 20200417225023  
property1: value1  
property2: value2  
property3: value3

The phrase 'Start time' should be the trigger for an event.  
All lines after are attached to this event.  
All lines after each 'Command start time' should be on the same level but in a sublevel of 'Start time'

Something like this:

```auto
Start time: 20200417225004
  property1: value1
  property2: value2
  property3: value3
  property4: value4
  Command start time: 20200417225016
    property1: value1
    property2: value2
  Command start time: 20200417225023
    property1: value1
    property2: value2
    property3: value3

```

Is that possible?

Best regards

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 17, 2020, 10:07pm UTC](https://discuss.elastic.co/t/nested-indexing-possible/228584/2 "2020-04-17T22:07:02Z")

</div>

You could do it with an aggregate filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2020, 10:21pm UTC](https://discuss.elastic.co/t/nested-indexing-possible/228584/3 "2020-05-15T22:21:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.