# Ingesting different formats from one json file

**URL:** <https://discuss.elastic.co/t/ingesting-different-formats-from-one-json-file/124658>\
**Category:** Logstash\
**Created:** [March 19, 2018, 10:45pm UTC](https://discuss.elastic.co/t/ingesting-different-formats-from-one-json-file/124658 "2018-03-19T22:45:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pororo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pororo/32/27711_2.png) [@Pororo](https://discuss.elastic.co/u/Pororo)\
**Post date:** [March 19, 2018, 10:45pm UTC](https://discuss.elastic.co/t/ingesting-different-formats-from-one-json-file/124658/1 "2018-03-19T22:45:01Z")

</div>

Hi,

My json file has two different formats of data.

For simple visualization,

 ![37](https://us1.discourse-cdn.com/elastic/original/3X/d/0/d07c51edf693f1333fec4cedd7c845dffefbeb62.png) ![47](https://us1.discourse-cdn.com/elastic/original/3X/1/3/1315202eac1c9d3684ecad9234f9100bd815ff0f.jpg)

I have read the document before and heard there is "conditional" operation in logstash filter. I am wondering how do I actually map them separately based on the operation field in my json. So basically, I will treat the operation which is not "evaluateRisk" as one group and the rest as one group to do the parsing.

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 20, 2018, 12:01am UTC](https://discuss.elastic.co/t/ingesting-different-formats-from-one-json-file/124658/2 "2018-03-20T00:01:53Z")

</div>

Please refer to the [docs](https://www.elastic.co/guide/en/logstash/6.2/event-dependent-configuration.html#conditionals), which contain examples.

```auto
filter {
  if [operation] == "evaluateRisk" {
    # ...
  } else {
    # ...
  }
}

```

---

<div class="post-metadata">

**Author:** ![Pororo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pororo/32/27711_2.png) [@Pororo](https://discuss.elastic.co/u/Pororo)\
**Post date:** [March 20, 2018, 12:27am UTC](https://discuss.elastic.co/t/ingesting-different-formats-from-one-json-file/124658/3 "2018-03-20T00:27:41Z")

</div>

Thank you so much.

May I ask one more question?

Will any property name which starts with "\_" cause the conflict for ES internal mapping?(In my example, "\_nestedCalls")

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 20, 2018, 5:37am UTC](https://discuss.elastic.co/t/ingesting-different-formats-from-one-json-file/124658/4 "2018-03-20T05:37:59Z")

</div>

I don't know whether it's enforced or not (I'm not on the Elasticsearch team), but I do know that the underscore prefix is considered "reserved" for fields that carry special semantic meaning within the Elastic Stack, so it would be wise to avoid. Thankfully, we have the "rename" feature within the mutate filter plugin, which makes renaming fields pretty easy.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2018, 5:38am UTC](https://discuss.elastic.co/t/ingesting-different-formats-from-one-json-file/124658/5 "2018-04-17T05:38:04Z")

</div>

Closed on April 17, 2018, 5:38am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.