title: How can I fully parse json into ElasticSearch?
body: <p>I'm parsing a mongodb input into logstash, the config file is as follows:</p>
  <pre><code>input {
      mongodb {
          uri =&gt; &quot;&lt;mongouri&gt;&quot;
          placeholder_db_dir =&gt; &quot;&lt;path&gt;&quot;
          collection =&gt; &quot;modules&quot;
          batch_size =&gt; 5000
      }
  }
  filter {
          mutate  {
              rename =&gt; { &quot;_id&quot; =&gt; &quot;mongo_id&quot; }
              remove_field =&gt; [&quot;host&quot;, &quot;@version&quot;]
          }
          json   {
              source =&gt; &quot;message&quot;
              target =&gt; &quot;log&quot;
          } 
  }
  output {
          stdout {
              codec =&gt; rubydebug
          }
          elasticsearch {
              hosts =&gt; [&quot;localhost:9200&quot;]
              action =&gt; &quot;index&quot;
              index =&gt; &quot;mongo_log_modules&quot;
          }
  }
  </code></pre>
  <p>Outputs 2/3 documents from the collection into elasticsearch.</p>
  <pre><code>{
      &quot;mongo_title&quot; =&gt; &quot;user&quot;,
        &quot;log_entry&quot; =&gt; &quot;{\&quot;_id\&quot;=&gt;BSON::ObjectId('60db49309fbbf53f5dd96619'), \&quot;title\&quot;=&gt;\&quot;user\&quot;, \&quot;modules\&quot;=&gt;[{\&quot;module\&quot;=&gt;\&quot;user-dashboard\&quot;, \&quot;description\&quot;=&gt;\&quot;User Dashborad\&quot;}, {\&quot;module\&quot;=&gt;\&quot;user-assessment\&quot;, \&quot;description\&quot;=&gt;\&quot;User assessment\&quot;}, {\&quot;module\&quot;=&gt;\&quot;user-projects\&quot;, \&quot;description\&quot;=&gt;\&quot;User projects\&quot;}]}&quot;,
         &quot;mongo_id&quot; =&gt; &quot;60db49309fbbf53f5dd96619&quot;,
          &quot;logdate&quot; =&gt; &quot;2021-06-29T16:24:16+00:00&quot;,
      &quot;application&quot; =&gt; &quot;mongo-modules&quot;,
       &quot;@timestamp&quot; =&gt; 2021-10-02T05:08:38.091Z
  }
  {
      &quot;mongo_title&quot; =&gt; &quot;candidate&quot;,
        &quot;log_entry&quot; =&gt; &quot;{\&quot;_id\&quot;=&gt;BSON::ObjectId('60db49519fbbf53f5dd96644'), \&quot;title\&quot;=&gt;\&quot;candidate\&quot;, \&quot;modules\&quot;=&gt;[{\&quot;module\&quot;=&gt;\&quot;candidate-dashboard\&quot;, \&quot;description\&quot;=&gt;\&quot;User Dashborad\&quot;}, {\&quot;module\&quot;=&gt;\&quot;candidate-assessment\&quot;, \&quot;description\&quot;=&gt;\&quot;User assessment\&quot;}]}&quot;,
         &quot;mongo_id&quot; =&gt; &quot;60db49519fbbf53f5dd96644&quot;,
          &quot;logdate&quot; =&gt; &quot;2021-06-29T16:24:49+00:00&quot;,
      &quot;application&quot; =&gt; &quot;mongo-modules&quot;,
       &quot;@timestamp&quot; =&gt; 2021-10-02T05:08:38.155Z
  }
  </code></pre>
  <p>Seems like the output of stdout throws un-parsable code into</p>
  <blockquote>
  <p>&quot;log_entry&quot;</p>
  </blockquote>
  <p>After adding &quot;rename&quot; fields &quot;modules&quot; won't add a field.</p>
  <p>I've tried the grok mutate filter, but after the _id %{DATA}, %{QUOTEDSTRING} and %{WORD} aren't working for me.</p>
  <p>I've also tried updating a nested mapping into the index, didn't seem to work either</p>
  <p>Is there anything else I can try to get the FULLY nested code into elasticsearch?</p>