Is it possible to substitute the value of a field from env variable in logstash

Elastic Stack Logstash
1

Hi,
I am using logstash-2.3.4. In my case, input file contains the ID of the operation, which I need to translate it to its name in the output. For example:
Input:

1,SUCCESS
2,SUCCESS
3,ERROR

Let's assume the numbers are operation IDs and 1=create, 2=update, 3=delete and added them in environment variable.

After matching the grok pattern, is there any way that I can directly substitute the values for the operation so that they are translated to their name.

Something like ${%{operation_id}} and it appears are create for 1 - where %{operation_id} is matched from grok.
I tried the way as I mentioned above but it appears as ${1} in the output.

2

Does it have to be an environment variable? Your use case sounds like a good fit for the translate filter.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.