Extract substring from log field and translate it via YAML file

Elastic Stack Logstash
1

Hi All,
I need to use an external YAML file to translate a field based on substring:

YAML File structure:
"testa": "application aaa"
"testb": "application bbb"
"testc": "application ccc"

LOG Field content:
...,"testa28903802",...
...,"testb1",....
...,"testc23",....

Which is the best way to accomplish this transformation ?

Thanx in advance!

2

Have you looked at the translate filter?

3

Yes, but as far as I understand a whole word match is required, so I'm trying to create a new destination field with the exact string I want to match, extracted from the source field

4

You should be able to use the grok filter to extract a suitable substring for an exact match, but the translate filter's regex option also looks promising.