Doc fields in CSV destination


(Albert) #1

Hi,

I'm very new in ELK stack and I'm trying to learn.

I'd like to enrich a document adding fields based on a translate filter and a dictionary_path value. My question is: when building the dictionary_path file, can I use fieds from the doc as part on the results?

I mean...Let's say I have a field called "Classe" and a field called "Severitat". Imagine I have this CSV dictionary for field "Classe" whose result is field "Missatge", which has to be filled using "Severitat" field's value:

"Severitat","Missatge"
"0","Missatge per a events de tipus %{Classe} igual a %{Severitat}"
"1","Missatge per a dades de tipus %{Classe} igual a %{Severitat}"

Can I build the "Missatge" field using a translate filter but using at the same time fields from the same document? Or does it have to be an static text?

Thanks,

Albert


(Magnus Bäck) #2

I believe the text needs to be static.


(Albert) #3

Hi,

That's what experience says to me.
I had to add a mutate->gsub after the csv filter to change labels for field values.

Shame...

Thanks!

Albert


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.