Is it possible to substitute the value of a field from env variable in logstash

(GS) #1

I am using logstash-2.3.4. In my case, input file contains the ID of the operation, which I need to translate it to its name in the output. For example:


Let's assume the numbers are operation IDs and 1=create, 2=update, 3=delete and added them in environment variable.

After matching the grok pattern, is there any way that I can directly substitute the values for the operation so that they are translated to their name.

Something like ${%{operation_id}} and it appears are create for 1 - where %{operation_id} is matched from grok.
I tried the way as I mentioned above but it appears as ${1} in the output.

(Magnus B├Ąck) #2

Does it have to be an environment variable? Your use case sounds like a good fit for the translate filter.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.