to nobody in particular, if you want elasticsearch to treat snapshot results the same as differential results, adding

if [action] == "snapshot" {
      split {
        field => "snapshot"
        target => "columns"
        remove_field => [ "snapshot" ]
      }

to your filter statement in logstash will do the job