How to replace field values from json external file?

I am getting messages from RabbitMQ with field name ResponseCode. Response code consist of short codes like , 00, 01, 02 and so on. I want to replace those values will full form. I have another json key:values pair file where all information is written related to those responsecodes. I am confuse how to achieve this use case.

One Condition is to use if condition of each Response code and replace with full Form but problem is that I have 500+ codes using that much if condition is difficult and wastage of processing power.

Need your help to resolve this problem? Is it possible?

You might be able to use the translate filter with the dictionary_path option depending on how that JSON is formatted.

Thanks for response sir, I have json file with this format,

{
   "00":"Approved",
   "01":"Error",
   "02":"Pending"
 }

and this file contains more than 500 codes.
How to read this file in logstash and compare with incoming field from RabbitMQ and replace codes with values in the files.

Untested, but by looking at the documentation I would try this.

filter { 
 translate {
  field => "[ResponseCode]"
  destination => "[ResponseText]"
  dictionary_path => "/etc/logstash/file.json"
 }
}
1 Like
 if[ResponseCode] == "00"{
        mutate {
            replace => { "ResponseCode" => "Approved" }
        }
    }

By using if condition we are performing like that. I am getting still confused about how to compare values in file and field, In Your code, we are getting field name and file path then what is function of destination?

Please read the documentation for this plugin as it will cover most of your questions. You can use Destination or Target for this if it meets your requirements.

Okay Sir, Thank You for your time.
Anyone have much idea about it.

1 Like

Sir this works exactly what I wanted. thank you so so much. It is like a miracle for me. :smiling_face_with_three_hearts: :heart_eyes:

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.