# Visualize child data in Kibana

**URL:** <https://discuss.elastic.co/t/visualize-child-data-in-kibana/93174>\
**Category:** Kibana\
**Created:** [July 14, 2017, 11:19am UTC](https://discuss.elastic.co/t/visualize-child-data-in-kibana/93174 "2017-07-14T11:19:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![amani](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@amani](https://discuss.elastic.co/u/amani)\
**Post date:** [July 14, 2017, 11:19am UTC](https://discuss.elastic.co/t/visualize-child-data-in-kibana/93174/1 "2017-07-14T11:19:48Z")

</div>

I would like to show the child data in Kibana@5.5 connected to ES@ 5.5

parent data:

{  
"\_index": "os\_data",  
"\_type": "computer",  
"\_id": "b8802d",  
"\_score": 1,  
"\_source": {  
"host\_os": "Professional",  
"os\_description": "windows\_7\_professional\_service\_pack\_1",  
"bios\_date": "2013-12-18T03:00:00-0500",  
"dns\_servers": "[192.168.127.159, 192.168.127.45, fec0:0:0:ffff::1%1, fec0:0:0:ffff::2%1, fec0:0:0:ffff::3%1]",  
"bios\_source": Copyright (c) 1982,2013 Hewlett-Packard Development Company L.P.\*\*\*\*\*\*",  
"display\_label": "Bobtail",  
"domain\_name": "test"  
}  
}

Child data:

{  
"\_index": "os\_log",  
"\_type": "log",  
"\_id": "AV1ATLT-iFL3OVCxtkQA",  
"\_version": 1,  
"\_score": null,  
"\_routing": "b8802d",  
"\_parent": "b8802d",  
"\_source": {  
"@timestamp": "2017-07-13T23:53:55-0400",  
"Count": "1",  
"Error Message": "SQL: Internal error. Details",  
"Severity": "Error",  
"Time Error Reported": "Friday, June 30, 2017 2:18:08 AM PDT",  
"Job": "Job1",  
}  
}

{  
"\_index": "os\_log",  
"\_type": "log",  
"\_id": "AV1ATLT-iFL3OVCxtkQB",  
"\_version": 1,  
"\_score": null,  
"\_routing": "b8802d",  
"\_parent": "b8802d",  
"\_source": {  
"@timestamp": "2017-07-13T23:53:55-0400",  
"Count": "1",  
"Error Message": "Failed: Terminated by user",  
"Severity": "Error",  
"Time Error Reported": "Friday, June 30, 2017 2:18:08 AM PDT",  
"Job": "Job2",  
}  
}

I can see the child data in Kibana and the below query in visualization search bar to filter parents based on child data  
{"has\_child": { "type": "os\_log", "query": { "match": { "Error Message": "SQL: Internal error" } } } }

I would like to show the data in visualization from Child I.E type: os\_log

any help will be appreciated.

Thanks

---

<div class="post-metadata">

**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\
**Post date:** [July 14, 2017, 11:23am UTC](https://discuss.elastic.co/t/visualize-child-data-in-kibana/93174/2 "2017-07-14T11:23:00Z")

</div>

I think you are looking for a way to JOIN ? (like in SQL) Kibana can't do that. The suggested approach would be to denormalize your data (add all parent keys to each child, so parent is no longer needed).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2017, 11:23am UTC](https://discuss.elastic.co/t/visualize-child-data-in-kibana/93174/3 "2017-08-11T11:23:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.