# Error translation event\_id

**URL:** <https://discuss.elastic.co/t/error-translation-event-id/189085>\
**Category:** Logstash\
**Created:** [July 5, 2019, 11:29am UTC](https://discuss.elastic.co/t/error-translation-event-id/189085 "2019-07-05T11:29:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![NauGui](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/naugui/32/49515_2.png) [@NauGui](https://discuss.elastic.co/u/NauGui)\
**Post date:** [July 5, 2019, 11:29am UTC](https://discuss.elastic.co/t/error-translation-event-id/189085/1 "2019-07-05T11:29:25Z")

</div>

Hi,  
I have a problem with one of my filter for event\_id.  
This one work perfectly :  
filter {

```
        mutate {

          convert => {
                "event_id" => "string"
}
}
        translate {
 field => "event_id"
          dictionary => {
"4720" => "Compte créer"
"4722" => "Compte activé"
"4723" => "Utilisateur change mdp"
"4725" => "Compte désactivé"
"4724" => "Admin change mdp"
"4740" => "Compte vérouiller"
"4726" => "Compte supprimé"
"4738" => "Compte modifié"
"4767" => "Compte dévérouiller"
"4781" => "Nom changé"

"5156" => "Autorisation de connexion"
"4634" => "Déconnexion"
"4624" => "Succès Connexion"
"4625" => "Echec Connexion"
"4647" => "Initialise déconnexion"
"4778" => "Session RDP connexion"
"4779" => "Session RDP déconnexion"

"4768" => "Ticket Kerberos"
"4771" => "Kerberos failed"
"4820" => "Kerberos refuser(restriction)"
       }
        destination => "convert.event_id"
        override => "true"
}
}

```

But not this one :

```
filter {
translate {
field => "event_data.SubStatus"

dictionary => {
"0xc0000064" => "existe pas"
"0xc000006a" => "user name"
"0xc0000234" => "user"
"0xc0000072" => "account"
"0xc000006f" => "usertime"
"0xc0000070" => "workstation"
"0xc0000193" => "account expiration"
"0xc0000071" => "expired password"
"0xc0000133" => "clock sync error"
"0xc0000224" => "user is required"
"0xc0000225" => "evidently"
"0xc000015b" => "The user has"
"0x80090325" => "test"
}

        destination => "convert.event_data.SubStatus"
        override => "true"
}
}

```

I looked in /var/log/logstash but I don't find any error.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 5, 2019, 3:17pm UTC](https://discuss.elastic.co/t/error-translation-event-id/189085/2 "2019-07-05T15:17:30Z")

</div>

> [@NauGui](#):
>
> field =\> "event\_data.SubStatus"

If your field name contains a dot that is correct, but if the event\_data object contains a SubStatus field then that should be [event\_data][SubStatus].

---

<div class="post-metadata">

**Author:** ![NauGui](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/naugui/32/49515_2.png) [@NauGui](https://discuss.elastic.co/u/NauGui)\
**Post date:** [July 8, 2019, 6:34am UTC](https://discuss.elastic.co/t/error-translation-event-id/189085/3 "2019-07-08T06:34:28Z")

</div>

Thx it's solve my problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 5, 2019, 6:34am UTC](https://discuss.elastic.co/t/error-translation-event-id/189085/4 "2019-08-05T06:34:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.