# Conditions in Ingest node pipeline

**URL:** <https://discuss.elastic.co/t/conditions-in-ingest-node-pipeline/104941>\
**Category:** Elasticsearch\
**Created:** [October 23, 2017, 5:27pm UTC](https://discuss.elastic.co/t/conditions-in-ingest-node-pipeline/104941 "2017-10-23T17:27:54Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pratiksha\_Tewary](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@Pratiksha\_Tewary](https://discuss.elastic.co/u/Pratiksha_Tewary)\
**Post date:** [October 23, 2017, 5:27pm UTC](https://discuss.elastic.co/t/conditions-in-ingest-node-pipeline/104941/1 "2017-10-23T17:27:54Z")

</div>

Hi,  
I want to know if its possible to apply conditions in ingest node pipelines. I need to apply grok processor based on the value of one particular field. So, I will apply grok processor to extract that field and then make a check on that field. Depending on the result, I will apply one of two grok patterns to the rest of the event.

Thanks.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [October 23, 2017, 10:26pm UTC](https://discuss.elastic.co/t/conditions-in-ingest-node-pipeline/104941/2 "2017-10-23T22:26:54Z")

</div>

Conditionals are not supported. Better doing that in Logstash for that kind of advanced use case IMO.

---

<div class="post-metadata">

**Author:** ![Pratiksha\_Tewary](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@Pratiksha\_Tewary](https://discuss.elastic.co/u/Pratiksha_Tewary)\
**Post date:** [October 26, 2017, 3:40pm UTC](https://discuss.elastic.co/t/conditions-in-ingest-node-pipeline/104941/3 "2017-10-26T15:40:23Z")

</div>

Thank you for your response. Just wanted to check, I found this link:

> <https://github.com/talevy/elasticsearch/commit/b711065aa9d4f8c77ec881b2a15cd5b6371ef641>

This is a repository for a processor called "conditional". However, I am not able to use it as of course I have not installed it. Is this a legit processor or is it not usable at the moment?

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [October 26, 2017, 3:58pm UTC](https://discuss.elastic.co/t/conditions-in-ingest-node-pipeline/104941/4 "2017-10-26T15:58:30Z")

</div>

A decision was made to _not_ include this in the Ingest node due to the complexity it would introduce. The Ingest node is for simpler pipelines.

As mentioned, if you need conditionals in your pipeline, you should be investigating Logstash.

---

<div class="post-metadata">

**Author:** ![Pratiksha\_Tewary](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@Pratiksha\_Tewary](https://discuss.elastic.co/u/Pratiksha_Tewary)\
**Post date:** [October 26, 2017, 4:04pm UTC](https://discuss.elastic.co/t/conditions-in-ingest-node-pipeline/104941/5 "2017-10-26T16:04:21Z")

</div>

Thanks again for the prompt response. I actually have already implemented it using Logstash configuration but it is the client's request to implement it using ingest node pipelines since carrying out advanced filtration in the logstash configuration leads to excess CPU consumption, which they want to minimize.

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [October 28, 2017, 3:09pm UTC](https://discuss.elastic.co/t/conditions-in-ingest-node-pipeline/104941/6 "2017-10-28T15:09:06Z")

</div>

What leads you to believe it would be any different in an ingest pipeline? Advanced filtering _will_ inevitably lead to higher CPU usage. If you need that level of filtering, plan for the needed CPU utilization and build your stack accordingly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 25, 2017, 3:09pm UTC](https://discuss.elastic.co/t/conditions-in-ingest-node-pipeline/104941/7 "2017-11-25T15:09:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
