# Ingest Processor Conditional

**URL:** <https://discuss.elastic.co/t/ingest-processor-conditional/236311>\
**Category:** Elasticsearch\
**Created:** [June 9, 2020, 10:12am UTC](https://discuss.elastic.co/t/ingest-processor-conditional/236311 "2020-06-09T10:12:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\
**Post date:** [June 9, 2020, 10:12am UTC](https://discuss.elastic.co/t/ingest-processor-conditional/236311/1 "2020-06-09T10:12:24Z")

</div>

I want to process data in the message field from a source if fields.log\_type is combinedlogs...but it's not working. Can someone help me there?  
Thanks in Advance.

Ingest Pipeline:

```auto
PUT _ingest/pipeline/pipeline_combined_logs
{
  "description" : "Process Combined Logs",
  "processors" : [
    {
  "dissect": {
    "if": "['fields']['log_type'] =='combinedlogs'",
    "field": "message",
    "pattern" : "%{eventdate}\t%{etime}\t%{logtype}\t%{loglevel}\t%{}\t%{host}\t%{user}|%{pid}|%{service}\t%{component_message}"
   }
},
    {
      "set": {
        "field": "edate",
        "value": "{{eventdate}} {{etime}}"
      }
    },
    {
      "date" : {
        "field" : "edate",
        "target_field" : "eventdate",
        "formats" : ["yyyy-MM-dd HH:mm:ss"]
      }
    },
    {
  "remove": {
    "field": "message"
  }
},
    {
      "date_index_name" : {
        "field" : "eventdate",
        "index_name_prefix" : "combined-",
        "date_rounding" : "M"
      }
    }
  ]
}

```

LogData:

```auto
PUT /combined/_doc/1?pipeline=pipeline_combined_logs
{
  "fields" : {"log_type":"combinedlogs"},
  "message": "Log-DATA-Here"
}

```

Error I get:

```auto
{
  "error" : {
    "root_cause" : [
      {
        "type" : "script_exception",
        "reason" : "compile error",
        "script_stack" : [
          "['fields']['log_type'] =='combinedlo ...",
          " ^---- HERE"
        ],
        "script" : "['fields']['log_type'] =='combinedlogs'",
        "lang" : "painless",
        "position" : {
          "offset" : 11,
          "start" : 0,
          "end" : 36
        }
      }
    ],
    "type" : "script_exception",
    "reason" : "compile error",
    "script_stack" : [
      "['fields']['log_type'] =='combinedlo ...",
      " ^---- HERE"
    ],
    "script" : "['fields']['log_type'] =='combinedlogs'",
    "lang" : "painless",
    "position" : {
      "offset" : 11,
      "start" : 0,
      "end" : 36
    },
    "caused_by" : {
      "type" : "class_cast_exception",
      "reason" : "Cannot cast from [java.lang.String] to [int]."
    }
  },
  "status" : 400
}

```

---

<div class="post-metadata">

**Author:** ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\
**Post date:** [June 9, 2020, 10:53am UTC](https://discuss.elastic.co/t/ingest-processor-conditional/236311/2 "2020-06-09T10:53:25Z")

</div>

I figured it out how to do that...  
I just need to change pipeline definition as follows

```auto
PUT _ingest/pipeline/pipeline_combined_logs
{
  "description" : "Process Combined Logs",
  "processors" : [
    {
  "dissect": {
    "if": "ctx.fields.log_type =='combinedlogs'",
    "field": "message",
    "pattern" : "%{eventdate}\t%{etime}\t%{logtype}\t%{loglevel}\t%{}\t%{host}\t%{user}|%{pid}|%{service}\t%{component_message}"
   }
},
    {
      "set": {
        "field": "edate",
        "value": "{{eventdate}} {{etime}}"
      }
    },
    {
      "date" : {
        "field" : "edate",
        "target_field" : "eventdate",
        "formats" : ["yyyy-MM-dd HH:mm:ss"]
      }
    },
    {
  "remove": {
    "field": "message"
  }
},
    {
      "date_index_name" : {
        "field" : "eventdate",
        "index_name_prefix" : "combined-",
        "date_rounding" : "M"
      }
    }
  ]
}

```

Instead of using

```auto
"if": "['fields']['log_type'] =='combinedlogs'"

```

Use

```auto
 "if": "ctx.fields.log_type =='combinedlogs'"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 7, 2020, 10:53am UTC](https://discuss.elastic.co/t/ingest-processor-conditional/236311/3 "2020-07-07T10:53:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.