Alter vs Translate vs If/Else statements

Elastic Stack Logstash
1

I am trying to determine what is the fastest/most-efficient/recommendation (I was thinking of either using Translate, Alter, or just If/Else statements) for performing actions on data such as the following.
$field has values of 7,8, and 9.
7 = Log
8 = Block
9 = Bypass
****The content would not be dynamic such as https://www.elastic.co/blog/bro-ids-elastic-stack where it was using a translate dictionary-path for TOR IPs.

I want to convert each "key"(integer) to its corresponding value... But as stated above, there seems to be 3 filters/options that may accomplish this.

2

I will close this..
Just going to chalk it up to I just need to test this myself by using metrics or some such.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.