# How to map a (filebeat) numeric field to display a customer name?

**URL:** <https://discuss.elastic.co/t/how-to-map-a-filebeat-numeric-field-to-display-a-customer-name/47837>\
**Category:** Logstash\
**Created:** [April 19, 2016, 8:57pm UTC](https://discuss.elastic.co/t/how-to-map-a-filebeat-numeric-field-to-display-a-customer-name/47837 "2016-04-19T20:57:35Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dgans](https://avatars.discourse-cdn.com/v4/letter/d/94ad74/32.png) [@dgans](https://discuss.elastic.co/u/dgans)\
**Post date:** [April 19, 2016, 8:57pm UTC](https://discuss.elastic.co/t/how-to-map-a-filebeat-numeric-field-to-display-a-customer-name/47837/1 "2016-04-19T20:57:35Z")

</div>

My **_filebeat client_** is sending data records with a numeric field name of 'accountID' to my elasticsearch server. When I create a (Kibana) visualization with this data, my graphs show the numberic 'accountID' values on the X-axis as expected. **My goal is to map these numeric accountID values to an actual customer name**. (Without the name, an accountID lookup in the database has to be executed, inefficient at best...) 😕  
**_My failed solution_** :

1. Inner Objects - Use the elasticsearch mechanism called Inner Objects by adding the following values to the 'filebeat-index-template.json  
{  
"accountID": [  
{ "ACCOUNT\_ID": "1674", "SHORT\_NAME": "Hickory"},  
{ "ACCOUNT\_ID": "887", "SHORT\_NAME": "Dickory"},  
{ "ACCOUNT\_ID": "862", "SHORT\_NAME": "Doc"},  
]  
}  
}

Any suggestions for this novice to display a customer name, rather than my vague account\_id??

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 19, 2016, 9:00pm UTC](https://discuss.elastic.co/t/how-to-map-a-filebeat-numeric-field-to-display-a-customer-name/47837/2 "2016-04-19T21:00:43Z")

</div>

If you send your records via Logstash it would be trivial to use a translate filter to do this mapping.

---

<div class="post-metadata">

**Author:** ![dgans](https://avatars.discourse-cdn.com/v4/letter/d/94ad74/32.png) [@dgans](https://discuss.elastic.co/u/dgans)\
**Post date:** [April 19, 2016, 9:20pm UTC](https://discuss.elastic.co/t/how-to-map-a-filebeat-numeric-field-to-display-a-customer-name/47837/3 "2016-04-19T21:20:59Z")

</div>

Thanks Magnus! I will investigate this option.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 19, 2016, 10:45pm UTC](https://discuss.elastic.co/t/how-to-map-a-filebeat-numeric-field-to-display-a-customer-name/47837/4 "2016-04-19T22:45:42Z")

</div>

You can't do this with ES, it needs to be done before the data is sent to it.

---

<div class="post-metadata">

**Author:** ![dgans](https://avatars.discourse-cdn.com/v4/letter/d/94ad74/32.png) [@dgans](https://discuss.elastic.co/u/dgans)\
**Post date:** [April 20, 2016, 8:47pm UTC](https://discuss.elastic.co/t/how-to-map-a-filebeat-numeric-field-to-display-a-customer-name/47837/5 "2016-04-20T20:47:20Z")

</div>

Magnus  
Thanks to your input, I installed the logstash-filter-translate plugin on my ELK server.

Based on what I read, I needed to configure the dictionary. I assume that the config file for this was located in **_/root/logstash-filter-translate-master/spec/filters/translate\_spec.rb_**

I added these lines:

describe "Account\_id translation" do

```
let(:config) do
  {
    "field" => "accountID",
    "destination" => "translation",
    "dictionary" => [ "1674", "Hickory",
                       "887", "Dickory",
                       "862", "Doc",
                       "1804", "Misc" ],
                       "exact" => true,
                       "regex" => false
  }
end

let(:event) { LogStash::Event.new("status" => 200) }

it "return the exact translation" do
  subject.register
  subject.filter(event)
  expect(event["translation"]).to eq("OK")
end

```

end

I restarted logstash with  
service logstash restart

I expected to see the translated accountID values in Kibana, **_but did not._**

**_Any suggestions on what I may have missed?_**

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 21, 2016, 5:37am UTC](https://discuss.elastic.co/t/how-to-map-a-filebeat-numeric-field-to-display-a-customer-name/47837/6 "2016-04-21T05:37:40Z")

</div>

Um, that's the tests for the plugin's source code. Editing it will get you nowhere. Use the plugin's [`dictionary_path` option](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html#plugins-filters-translate-dictionary_path) to select which file contains the mappings you want to make.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/how-to-map-a-filebeat-numeric-field-to-display-a-customer-name/47837/7 "2017-07-06T05:01:19Z")

</div>