# How to prevent clobbering in translate filter
**URL:** https://discuss.elastic.co/t/how-to-prevent-clobbering-in-translate-filter/280008
**Category:** Logstash
**Created:** [July 29, 2021, 6:02pm UTC](https://discuss.elastic.co/t/how-to-prevent-clobbering-in-translate-filter/280008 "2021-07-29T18:02:36Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)
#### Post date: [July 29, 2021, 6:02pm UTC](https://discuss.elastic.co/t/how-to-prevent-clobbering-in-translate-filter/280008/1 "2021-07-29T18:02:36Z")
Hello ,
I'm using translate filter with a set of mappings in dictionary .
```auto
{
"@timestamp" => 2021-07-23T11:52:08.000Z,
"Flag" => "16464",
"Flag_Definition" => "liveness test timed outMachine lost serviceservice failed liveness check in last 30 sec"
}
```
The flag definition field works as expected , but the output seems appended to each other i.e
16464 is a combination of "liveness test timed out" and "Machine lost service" and "service failed liveness check in last 30 sec"
But the result seems to be appended . Is there a way we can seperate them ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 29, 2021, 7:24pm UTC](https://discuss.elastic.co/t/how-to-prevent-clobbering-in-translate-filter/280008/2 "2021-07-29T19:24:50Z")
How is the translate filter configured?
---
### Author:  [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)
#### Post date: [July 30, 2021, 3:37am UTC](https://discuss.elastic.co/t/how-to-prevent-clobbering-in-translate-filter/280008/3 "2021-07-30T03:37:12Z")
Here's the translate filter
```auto
translate
{
field => "[Flag]"
destination => "[Flag_Definition]"
dictionary => {
"4" => "Machine lost service"
"16" => "liveness test timed out"
"64" => "service failed liveness check in last 30 sec"
"512" => "stopped"
"2048" => "lost certs"
}
fallback => "Unknown Flag"
exact => false
```
I do need to create some more combinations of these flag, im not sure if translate is the right filter .
For example : the flag 2560 is a combination of
512:stopped
2048: lost certs
I need this to be displayed on the destination field.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 30, 2021, 3:02pm UTC](https://discuss.elastic.co/t/how-to-prevent-clobbering-in-translate-filter/280008/4 "2021-07-30T15:02:27Z")
> [@Shreesh\_Narayanan](#):
>
> im not sure if translate is the right filter
I suspect not. You could convert the flag to binary
```
ruby {
code => '
flag = event.get("Flag")
if flag {
event.set("[@metadata][flags]", flag.to_i.to_s(2))
}
'
}
```
then use grok to pick out each bit and test it. However, it might be easier to just do the whole thing in ruby.
```
ruby {
code => '
flag = event.get("Flag").to_i
flags = []
if 0 != flag & 4 ; flags << "Machine lost service" ; end
if 0 != flag & 16; flags << "liveness test timed out" ; end
if 0 != flag & 64; flags << "service failed liveness check in last 30 sec" ; end
if 0 != flag & 512; flags << "stopped" ; end
if 0 != flag & 2048; flags << "lost certs" ; end
event.set("Flag_Definition", flags)
'
}
```
---
### Author:  [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)
#### Post date: [July 30, 2021, 4:50pm UTC](https://discuss.elastic.co/t/how-to-prevent-clobbering-in-translate-filter/280008/5 "2021-07-30T16:50:51Z")
Thank you so much 🙂 @Badger , this works perfectly .
I'm not familiar with ruby code , could you let me know if there's some basic documentation on Logstash's ruby implementation ? I'd like to understand the code .
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 27, 2021, 4:51pm UTC](https://discuss.elastic.co/t/how-to-prevent-clobbering-in-translate-filter/280008/6 "2021-08-27T16:51:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.