Doc fields in CSV destination

Elastic Stack Logstash
1

Hi,

I'm very new in ELK stack and I'm trying to learn.

I'd like to enrich a document adding fields based on a translate filter and a dictionary_path value. My question is: when building the dictionary_path file, can I use fieds from the doc as part on the results?

I mean...Let's say I have a field called "Classe" and a field called "Severitat". Imagine I have this CSV dictionary for field "Classe" whose result is field "Missatge", which has to be filled using "Severitat" field's value:

"Severitat","Missatge"
"0","Missatge per a events de tipus %{Classe} igual a %{Severitat}"
"1","Missatge per a dades de tipus %{Classe} igual a %{Severitat}"

Can I build the "Missatge" field using a translate filter but using at the same time fields from the same document? Or does it have to be an static text?

Thanks,

Albert

2

I believe the text needs to be static.

3

Hi,

That's what experience says to me.
I had to add a mutate->gsub after the csv filter to change labels for field values.

Shame...

Thanks!

Albert

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.