How to replace field values from json external file?

[padamrai]

I am getting messages from RabbitMQ with field name ResponseCode. Response code consist of short codes like , 00, 01, 02 and so on. I want to replace those values will full form. I have another json key:values pair file where all information is written related to those responsecodes. I am confuse how to achieve this use case.

One Condition is to use if condition of each Response code and replace with full Form but problem is that I have 500+ codes using that much if condition is difficult and wastage of processing power.

Need your help to resolve this problem? Is it possible?

[aaron-nimocks]

You might be able to use the translate filter with the dictionary_path option depending on how that JSON is formatted.

[padamrai]

Thanks for response sir, I have json file with this format,

{
   "00":"Approved",
   "01":"Error",
   "02":"Pending"
 }

and this file contains more than 500 codes.
How to read this file in logstash and compare with incoming field from RabbitMQ and replace codes with values in the files.

[aaron-nimocks]

Untested, but by looking at the documentation I would try this.

filter { 
 translate {
  field => "[ResponseCode]"
  destination => "[ResponseText]"
  dictionary_path => "/etc/logstash/file.json"
 }
}

[padamrai]

 if[ResponseCode] == "00"{
        mutate {
            replace => { "ResponseCode" => "Approved" }
        }
    }

By using if condition we are performing like that. I am getting still confused about how to compare values in file and field, In Your code, we are getting field name and file path then what is function of destination?

[aaron-nimocks]

Please read the documentation for this plugin as it will cover most of your questions. You can use Destination or Target for this if it meets your requirements.

[padamrai]

Okay Sir, Thank You for your time.
Anyone have much idea about it.

[padamrai]

Sir this works exactly what I wanted. thank you so so much. It is like a miracle for me.