How to do source to "multi target" translate in logstash?

Elastic Stack Logstash
1

We have got a CSV lookup as follows

EmpID,EmpName,EmpSalary,EmpDepartment
1001,Bob,10000,XX
1002,Joe,20000,YY
1003,Foo,30000,ZZ

and in Logstash, we need to translate the EmpID to both EmpName & EmpSalary at the same time. I know we can do it in multiple steps but ideally looking to see if there is a method similar to lookup functionality in Splunk to do all in one-step?

Ideally looking for something like below (as below don't work)

      translate {
        field => "[EmpID]"
        destination => "[EmpName],[EmpSalary],[EmpDepartment]"
        dictionary_path => "my_emp_file.csv"
        override => true
      }
2

See here and read through this thread.

3

thanks Badger. This solves as a workaround, but would like to have a multi-destination option. Will raise it as a feature request in logstash github

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.