# Add description to my logstas index based on another csv field

**URL:** https://discuss.elastic.co/t/add-description-to-my-logstas-index-based-on-another-csv-field/325002
**Category:** Elasticsearch
**Created:** [February 8, 2023, 10:49am UTC](https://discuss.elastic.co/t/add-description-to-my-logstas-index-based-on-another-csv-field/325002 "2023-02-08T10:49:55Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Miriam](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@Miriam](https://discuss.elastic.co/u/Miriam)
#### Post date: [February 8, 2023, 10:49am UTC](https://discuss.elastic.co/t/add-description-to-my-logstas-index-based-on-another-csv-field/325002/1 "2023-02-08T10:49:55Z")

</div>

I have my index created using logstah config file. Reading from log file following information:

```auto
id, iduser,datetimInit, dateTimeends
0001 210 2023-02-03 04:45:16.78 2023-02-03 04:46:16.78
0002 1003 2023-02-03 08:45:16.78 2023-02-03 08:46:16.78
0003 210 2023-02-04 04:45:16.78 2023-02-04 04:46:16.78

```

This is my config file:

```auto
filter {	
	grok {
		match => { 
			"message" => "%{NUMBER:id} %{NUMBER:idUser} %{TIMESTAMP_ISO8601:dateTimeInit} %{TIMESTAMP_ISO8601:dateTimeEnds}" 
		}
	}
}

```

On another csv file I have de full name if all users like that:

```auto
iduser,fullusername
210,Rosa Leon
200,Ana Quintero
1003,Marta Torres

```

I need to add user name field (fullname) from another csv file with this structure:

I do not hnow how to get user full name to add to my index from csv file and match by iduser. I nedd to get this full information into mi index using logstash file configuration:

```auto
0001 210 2023-02-03 04:45:16.78 2023-02-03 04:46:16.78 Rosa Leon
0002 1003 2023-02-03 08:45:16.78 2023-02-03 08:46:16.78 Marta Torres
0003 210 2023-02-04 04:45:16.78 2023-02-04 04:46:16.78 Rosa Leon

```

Matched by idUser

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 8, 2023, 12:37pm UTC](https://discuss.elastic.co/t/add-description-to-my-logstas-index-based-on-another-csv-field/325002/2 "2023-02-08T12:37:17Z")

</div>

You can do that with the [translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) filter.

---

<div class="post-metadata">

### Author: ![Miriam](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@Miriam](https://discuss.elastic.co/u/Miriam)
#### Post date: [February 8, 2023, 1:48pm UTC](https://discuss.elastic.co/t/add-description-to-my-logstas-index-based-on-another-csv-field/325002/3 "2023-02-08T13:48:25Z")

</div>

Thank you!  
After reading the documentation, I have included:

```auto
      filter {
          csv {
          columns => ["iduser","fullusername"]
          separator => ","
          }
	translate {
		dictionary_path => "<path>/userdescripcion.csv"
		source => "fullusername" #second column of my csv file userdescripcion.csv
		target => "iduser" #identifier
    }
}

```

But nothing happends, Any suggestion?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 8, 2023, 3:58pm UTC](https://discuss.elastic.co/t/add-description-to-my-logstas-index-based-on-another-csv-field/325002/4 "2023-02-08T15:58:21Z")

</div>

Why you added this csv filter? You do not need this, you are already parsing your message with the grok filter, right?

```auto
filter {	
	grok {
		match => { 
			"message" => "%{NUMBER:id} %{NUMBER:idUser} %{TIMESTAMP_ISO8601:dateTimeInit} %{TIMESTAMP_ISO8601:dateTimeEnds}" 
		}
	}
}

```

This creates the `idUser` field that you will use in the translate filter as the source.

Your translate filter needs to be something like this:

```auto
	translate {
		dictionary_path => "<path>/userdescripcion.csv"
		source => "idUser"
		target => "fullusername"
    }

```

And your `userdescripcion.csv` should look like this:

```auto
210,Rosa Leon
200,Ana Quintero
1003,Marta Torres

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 8, 2023, 3:58pm UTC](https://discuss.elastic.co/t/add-description-to-my-logstas-index-based-on-another-csv-field/325002/5 "2023-03-08T15:58:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
