# Tie together events with subfields

**URL:** <https://discuss.elastic.co/t/tie-together-events-with-subfields/28673>\
**Category:** Logstash\
**Created:** [September 4, 2015, 10:51am UTC](https://discuss.elastic.co/t/tie-together-events-with-subfields/28673 "2015-09-04T10:51:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sissi](https://avatars.discourse-cdn.com/v4/letter/s/82dd89/32.png) [@sissi](https://discuss.elastic.co/u/sissi)\
**Post date:** [September 4, 2015, 10:51am UTC](https://discuss.elastic.co/t/tie-together-events-with-subfields/28673/1 "2015-09-04T10:51:43Z")

</div>

i have a question about tie events together with subfields,log file like following:

### LOG FILE

id 1 name paris-1-university city paris country French  
id 1 namestu cici age 18 sex F

id 1 name paris-3-university city london country England  
id 1 namestu toto age 21 sex M  
... ...

structure i want, like the following:  
{  
\_id": "1",  
"schstu1": {  
"sch": {  
"name": "paris-1-university",  
"city": "paris",  
"country": "French",  
},  
"stu": {  
"namestu": "cici",  
"age": "18",  
"sex": "F",  
}  
}  
"schstu2": {  
"sch": {  
"name": "paris-3-university",  
"city": "london",  
"country": "England",  
},  
"stu": {  
"namestu": "toto",  
"age": "21",  
"sex": "M",  
}  
}  
"schstu3" {  
.....  
}   
"schstu4" {  
.....  
}   
}

but now, t try to use logstash to index data into Elasticsearch (tie mulitiline by "id"),the result is like the following:  
{  
\_id": "1",  
"schstu1": {  
"sch": {  
"name":[  
"paris-1-university",  
"paris-3-university"  
]  
"city": [  
"paris",  
"london"  
]  
"country":[  
"French",  
"England"  
]  
},  
"stu": {  
"namestu": [  
"cici",  
"toto"  
]  
"age": [  
"18",  
"21"  
]  
"sex":[  
"F",  
"M"  
]  
}  
}  
}   
how can i fix these problem, anyone can help, thanks advance

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 6, 2015, 2:27pm UTC](https://discuss.elastic.co/t/tie-together-events-with-subfields/28673/2 "2015-09-06T14:27:27Z")

</div>

While I don't have a solution to your problem, it has nothing to do with logstash-forwarder. You might have better luck posting it in the Logstash category. You should be able to edit your first post and change its category.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:29am UTC](https://discuss.elastic.co/t/tie-together-events-with-subfields/28673/3 "2017-07-06T05:29:53Z")

</div>

Closed on July 6, 2017, 5:29am UTC