Parent-Child Relationship with logstash

Elastic Stack Logstash
1

I try to integrade child data with logstash but I can't.
For example I tried to use a _parent field with the value of the parent id but it did'nt work.
Do you have any idea ?

2

You can't do this with logstash unfortunately.

3

This is kinda sad, actually. It appears that some work has already been done in that direction, all that seems to be missing is somebody writing a test: https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/175

1 Like
4

Feel free to +1 the PR so it gets some attention :slight_smile:

5

Perhaps you can 'workaround' using the nested field syntax ?

i.e.

%{NUMBER:[cpu][load1]:float}
%{NUMBER:[cpu][load5]:float}
%{NUMBER:[cpu][load15]:float}

which should translate to elastic fields like cpu.load1 etc.

Hope to help,
Thorsten

6

Wouldn't that be a nested relationship as opposed to parent-child relationship?