# How to correctly use translate in Logstash?

**URL:** <https://discuss.elastic.co/t/how-to-correctly-use-translate-in-logstash/47067>\
**Category:** Logstash\
**Created:** [April 12, 2016, 3:20am UTC](https://discuss.elastic.co/t/how-to-correctly-use-translate-in-logstash/47067 "2016-04-12T03:20:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nateuni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nateuni/32/8512_2.png) [@nateuni](https://discuss.elastic.co/u/nateuni)\
**Post date:** [April 12, 2016, 3:20am UTC](https://discuss.elastic.co/t/how-to-correctly-use-translate-in-logstash/47067/1 "2016-04-12T03:20:55Z")

</div>

[This is an example of my data in Kibana](http://postimg.org/image/fnxlvawx3/) and what I am doing in Logstash with groks and some background info can be found [here](https://discuss.elastic.co/t/how-to-correctly-parse-and-then-enrich-log-data-in-logstash/46244/9).

I have categories, subcategories and products which can be seen in the Kibana screen capture above. An example of each would be: banking (category), transaction account (subcategory) and an everyday account (product). I want to be able to translate logs that only contain info about a product to also include their category and subcategory. I understand the I need to use translate to do this and that I could have a yaml file with key-value pairs from which I could pull data from [as discussed here](http://www.505forensics.com/utilizing-dictionaries-with-logstash/).

But in this context, I do not understand what I would exactly need to my config file to solve this problem. Can someone please help?

---

<div class="post-metadata">

**Author:** ![nateuni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nateuni/32/8512_2.png) [@nateuni](https://discuss.elastic.co/u/nateuni)\
**Post date:** [April 13, 2016, 1:55pm UTC](https://discuss.elastic.co/t/how-to-correctly-use-translate-in-logstash/47067/2 "2016-04-13T13:55:33Z")

</div>

So thanks to [this webpage](http://www.505forensics.com/utilizing-dictionaries-with-logstash/), I figured out the solution was to have this transformation:

```
translate {  
	regex => true 
	field => "product" 
	destination => "category" 
	dictionary => ["(everyday-account)|(streamline-basic)|(goal-saver)|(netbank-saver)|(awards-card)|(low-rate-card)", "banking", "(base-variable-rate-home-loan)|(fixed-rate-home-loan)","home-buying","(managed-funds)|(property-investment-fund)|(share-trading)", "investing"]
}
translate { 
	regex => true 
	field => "product" 
	destination => "subcategory" 
	dictionary =>["(everyday-account)|(streamline-basic)","transaction-account","(goal-saver)|(netbank-saver)","savings-account","(awards-card)|(low-rate-card)","credit-cards"] 
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/how-to-correctly-use-translate-in-logstash/47067/3 "2017-07-06T05:02:26Z")

</div>