Compare/Merge 2 type of dataset

[Peter_Ch]

Dear All,

I user winlogbeat to collet my window log which include username. And I have a csv file which contain the username and user department. May I know is it possible to compare those datasets username field, if those username are same, add department to the winlogbeat log?

Thanks

Best Regards
Peter

[leandrojmp (Leandro Pereira)]

You can use the translate filter in logstash to that.

[Peter_Ch]

I tried but fail. I use below code for window log but no result return even no department field show up. However, i use csv for testing is success. they are same code. Any idea?

filter {
  translate {
    field => ["winlog.user.name"]
    destination => ["department"]
    fallback => "not_found"
	dictionary_path => "D:\elastic\logstash-7.14.0\config\test.yaml"
  }
    }

[Badger]

@Peter_Ch

field => ["winlog.user.name"]

In logstash, that would be a field with two dots in its name, not a field within a field within a field. Use

field => "[winlog][user][name]"

[Peter_Ch]

Dear Badger,

It works!! thanks!