# Add human readable field with lookup

**URL:** <https://discuss.elastic.co/t/add-human-readable-field-with-lookup/325032>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 8, 2023, 2:27pm UTC](https://discuss.elastic.co/t/add-human-readable-field-with-lookup/325032 "2023-02-08T14:27:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tonelk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tonelk/32/39448_2.png) [@tonelk](https://discuss.elastic.co/u/tonelk)\
**Post date:** [February 8, 2023, 2:27pm UTC](https://discuss.elastic.co/t/add-human-readable-field-with-lookup/325032/1 "2023-02-08T14:27:44Z")

</div>

Hi,  
I want to add the human readable description of error codes in my data. I've tried this

```auto
processors:
 - add_fields:
     when:
       equals:
         cisco_code: "106015"
     fields:
       cisco_description: 'Deny TCP (no connection) from A to B flags RST ACK on interface x'
 - add_fields:
     when:
       equals:
         cisco_code: "313005"
     fields:
       cisco_description: 'No matching connection for ICMP error message'

```

which works, but isn't very maintainable. I do have a csv with the info i'd like

```auto
106015;Deny TCP (no connection) from A to B flags RST ACK on interface x
313005;No matching connection for ICMP error message

```

Is there a way to make use of that csv file to do this?

Thnx  
Ton

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 8, 2023, 3:53pm UTC](https://discuss.elastic.co/t/add-human-readable-field-with-lookup/325032/2 "2023-02-08T15:53:43Z")

</div>

Are you using Logstash or sending direct from beats to elasticsearch?

If you are using logstash you may easily do it using the `translate` filter.

If you are sending it direct to Elasticsearch you may need to use the enrich processor, but you would need to create an index with the content of your csv and keep this updated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2023, 5:53pm UTC](https://discuss.elastic.co/t/add-human-readable-field-with-lookup/325032/3 "2023-03-08T17:53:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.