How use translate in json object?

This is my json:

{"serial_number":"36307","time":"2017-11-20 08:10:40.340 +03:00","transaciton_id":"","card_hash":"","component":"READER","level":"DEBUG","message":"Request": SrvOpen: SrvOpenRequest: {"TgComName":"/dev/oti"}"}

I need translate my field serial_number according with my yml file.

krotov@test:~$ cat /etc/logstash/dict.yml
"36322": It worked!
So. How i can translate this field?
My config:

input {
tcp {
port => 5044
host => ''
filter {
date {
match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
remove_field => [ "timestamp" ]
json {
source => "message"
target => "css"
remove_field => "message"
add_field => {"sn" => "%{serial_number}" } ###- this not work. in kibana saw sn: %{serial_number}. ###
translate {
field => "serial_number"
destination => "translate"
dictionary_path => "/etc/logstash/dict.yml"
override => "true"
output {
elasticsearch {
hosts => ""
index => "mgt"
codec => rubydebug
document_type => "%{[@metadata][type]}"

Pls help with this. Sorry for bad language

###- this not work. in kibana saw sn: %{serial_number}.

That indicates that your document doesn't have a serial_number field, which would also explain why the translate filter isn't working. Show a complete example document, e.g. by using a stdout { codec => rubydebug } output.

Thank you. output there:

output received {"event"=>{"css"=>{"card_hash"=>"", "component"=>"PLATFORM", "level"=>"DEBUG", "serial_number"=>"36307", "time"=>"2017-11-20 08:10:40.332 +03:00", "transaciton_id"=>"", "message"=>"Получена команда от АСКП"}, "@timestamp"=>2017-11-21T07:17:23.943Z, "port"=>34116, "@version"=>"1", "host"=>"localhost", "@metdata"=>{"ip_address"=>""}, "sn"=>"%{serial_number}"}}

If your json document has a serial_number field, you are putting this under css as you have the target parameter set. This means that you would need to specify %{[css][serial_number]}.

It worked!
Thank you!
This way exist in documentation? I could not find.

Here is an example of how to address nested fields.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.