Cannot translate value inside fields

Elastic Stack Logstash
1

Hi,

I am using logstash 7.3.1 and trying to translate value inside the field after renaming. Basically I want to use translate plugin to translate the value inside the field and populate in same field or different field. If possible don`t want to use dictionary file and point it to file location. I dont know where am I going wrong as its not translating values.

filter {
if [type] == "logs" {
grok {
match => { "message" => ["%{TIMESTAMP_ISO8601:timestamp}%{DATA:loglevel}%{SYSLOGHOST:loglevel}%{DATA:source}%{GREEDYDATA:message}"] }
}
mutate {
rename => { "[loglevel]" => "[syslog_severity]" }
}
mutate {
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}

translate {
field => "loglevel"
destination => "syslog_severity"
 dictionary => {
  "TRACE" => "DEBUG"
  "DEBUG" => "DEBUG"
  "INFO" => "INFO"
  "WARN" => "WARN"
  "ERROR" => "ERROR"
  "FATAL" => "CRITICAL"
}
  remove_field => "loglevel"

}
}
}

2

The [loglevel] field will not exist when the translate filter executes because you have previously used mutate+rename to rename it.

3

Thanks that fixed the problem.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.