Ingesting different formats from one json file

[Pororo]

Hi,

My json file has two different formats of data.

For simple visualization,

I have read the document before and heard there is "conditional" operation in logstash filter. I am wondering how do I actually map them separately based on the operation field in my json. So basically, I will treat the operation which is not "evaluateRisk" as one group and the rest as one group to do the parsing.

[yaauie (Ry Biesemeyer)]

Please refer to the docs, which contain examples.

filter {
  if [operation] == "evaluateRisk" {
    # ...
  } else {
    # ...
  }
}

[Pororo]

Thank you so much.

May I ask one more question?

Will any property name which starts with "_" cause the conflict for ES internal mapping?(In my example, "_nestedCalls")

[yaauie (Ry Biesemeyer)]

I don't know whether it's enforced or not (I'm not on the Elasticsearch team), but I do know that the underscore prefix is considered "reserved" for fields that carry special semantic meaning within the Elastic Stack, so it would be wise to avoid. Thankfully, we have the "rename" feature within the mutate filter plugin, which makes renaming fields pretty easy.