# Extract substring from log field and translate it via YAML file
**URL:** https://discuss.elastic.co/t/extract-substring-from-log-field-and-translate-it-via-yaml-file/58897
**Category:** Logstash
**Created:** [August 25, 2016, 7:36am UTC](https://discuss.elastic.co/t/extract-substring-from-log-field-and-translate-it-via-yaml-file/58897 "2016-08-25T07:36:27Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@fantaghost](https://discuss.elastic.co/u/fantaghost)
#### Post date: [August 25, 2016, 7:36am UTC](https://discuss.elastic.co/t/extract-substring-from-log-field-and-translate-it-via-yaml-file/58897/1 "2016-08-25T07:36:27Z")
Hi All,
I need to use an external YAML file to translate a field based on substring:
**YAML File structure:**
"testa": "application aaa"
"testb": "application bbb"
"testc": "application ccc"
**LOG Field content:**
...,"testa28903802",...
...,"testb1",....
...,"testc23",....
Which is the best way to accomplish this transformation ?
Thanx in advance!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 25, 2016, 7:45am UTC](https://discuss.elastic.co/t/extract-substring-from-log-field-and-translate-it-via-yaml-file/58897/2 "2016-08-25T07:45:26Z")
Have you looked at the translate filter?
---
### Author:  [@fantaghost](https://discuss.elastic.co/u/fantaghost)
#### Post date: [August 25, 2016, 7:47am UTC](https://discuss.elastic.co/t/extract-substring-from-log-field-and-translate-it-via-yaml-file/58897/3 "2016-08-25T07:47:45Z")
Yes, but as far as I understand a whole word match is required, so I'm trying to create a new destination field with the exact string I want to match, extracted from the source field
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 25, 2016, 7:52am UTC](https://discuss.elastic.co/t/extract-substring-from-log-field-and-translate-it-via-yaml-file/58897/4 "2016-08-25T07:52:37Z")
You should be able to use the grok filter to extract a suitable substring for an exact match, but the translate filter's `regex` option also looks promising.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/extract-substring-from-log-field-and-translate-it-via-yaml-file/58897/5 "2017-07-06T04:41:41Z")