# Conditional processing in txt file

**URL:** <https://discuss.elastic.co/t/conditional-processing-in-txt-file/306654>\
**Category:** Logstash\
**Created:** [June 8, 2022, 8:47am UTC](https://discuss.elastic.co/t/conditional-processing-in-txt-file/306654 "2022-06-08T08:47:56Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [June 8, 2022, 8:47am UTC](https://discuss.elastic.co/t/conditional-processing-in-txt-file/306654/1 "2022-06-08T08:47:56Z")

</div>

Hi  
I need to make a parsing data through logstash but in the one txt file consists four different pattern  
How to make logstash for write to another index after encountering a given particular pattern.  
I am also asking for help in setting up a grok pattern for sample data.

sample data raw:

```auto
# snapshot,65767220,20220601044503
# Network Elements

0097,s,n,2719,,s,,,,3,,p,

C313,s,n,4767,,s,,y,,,,,

C314,s,n,2701,,s,,y,,,,,

C0108,s,n,14101,,g,,,,,,p,

CC110,s,n,14641,,s,,,,3,,r,

CC111,s,n,14642,,s,,,,3,,r,

CC112,s,n,14641,,s,,,,3,,r,

CC113,s,n,14640,,s,,,,3,,r,

CC114,s,n,14642,,s,,,,3,,r,

# DNs

C0108,,1,,,,,,,,,-2

146746481,,,CC318,,,,,,,,-2

158656701,,,,C1597,,,,,,,-2

483895991,,1,,C4898,,,,,,,-2

487359076,,,,CC40,,,,,,,-2

487359078,,,,CC40,,,,,,,-2

487359077,,,,CC40,,,,,,,-2

602560130,,,CC191,,,,,,,,-2

602560131,,,CC191,,,,,,,,-2

# DN Blocks

224135896,224135897,,,,,,,,,,,

606019700,606019799,,CC118,,,,,,,,,

728441381,728441390,0,,CC40,,,,,,,,

4873590760,4873590789,0,,CC40,,,,,,,,

48120000000,48122112649,0,,,,,,,,,,

48122112650,48122112659,0,,CC40,,,,,,,,

# IMEIs

00000801163158,0,n,n,y

00001004020051,0,n,n,y

00006053206182,0,n,n,y

00006053303925,0,n,n,y

00007504958630,0,n,n,y

00009053373401,0,n,n,y

00060633330647,0,n,n,y

00090533747262,0,n,n,y

```

header for particular rows =\>

```auto
# Network Elements:
%{ID},%{Type},%{PCType},%{PC},%{GC},%{RI},%{SSN},%{CCGT},%{NTT},%{NNAI},%{NNP},%{DA},%{SRFIMSI}

# DNs:
%{DN},%{IMSI},%{PT},%{SP},%{RN},%{VMS},%{GRN},%{ASD},%{ST},%{NSDN},%{CGBL},%{CDBL}

# DN Blocks
%{BDN},%{EDN},%{PT},%{SP},%{RN},%{VMS},%{GRN},%{ASD},%{ST},%{NSDN},%{CGBL},%{CDBL}

# IMEIs
%{IMEI},%{SVN},%{WHITE},%{GRAY},%{BLACK}

```

Many Thanks

---

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [June 8, 2022, 1:37pm UTC](https://discuss.elastic.co/t/conditional-processing-in-txt-file/306654/2 "2022-06-08T13:37:38Z")

</div>

the main case is: How to set the condition for multiply pattern for 4 blocks of different kind of data: "# Network Elements" "#DNs" "# DN Blocks" "# IMEIs"  
But on the other hand `dissect` only supports one mapping for each field.

---

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [June 8, 2022, 5:49pm UTC](https://discuss.elastic.co/t/conditional-processing-in-txt-file/306654/3 "2022-06-08T17:49:06Z")

</div>

Any idea for approach ?

---

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [June 12, 2022, 7:47pm UTC](https://discuss.elastic.co/t/conditional-processing-in-txt-file/306654/4 "2022-06-12T19:47:03Z")

</div>

Can anyone help to find out the solution?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 12, 2022, 8:10pm UTC](https://discuss.elastic.co/t/conditional-processing-in-txt-file/306654/5 "2022-06-12T20:10:31Z")

</div>

See [this](https://discuss.elastic.co/t/using-ruby-to-count-the-number-of-fields-in-a-message-then-apply-csv-depending-on-the-count/177880/2) thread.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2022, 8:11pm UTC](https://discuss.elastic.co/t/conditional-processing-in-txt-file/306654/6 "2022-07-10T20:11:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.