I don't know if I'm using this wrongly or if it's a problem with the filter, but, I have the following structure:
{
...,
"eventDataSplit" => {
"1" => {
"valueKey" : "1.1.1"
},
"2" => {
"valueKey" : "2.1.1"
},
"3" => {
"valueKey" : "3.1.1"
}
}
And I want to translate the "valueKey" from a .csv file or .json using the property iterate_on:
CSV (tried with quotes too)
1.1.1,one thing
2.1.1,another thing
JSON
{
"1.1.1":"one thing",
"2.1.1":"another thing"
}
Filter
translate {
iterate_on => "[eventDataSplit]"
dictionary_path => "\path-to\translateKey.json"
field => "[valueKey]"
destination => "[valueDescription]"
fallback => "-1"
}
The expected result is:
{
...,
"eventDataSplit" => {
"1" => {
"valueKey" : "1.1.1",
"valueDescription": "one thing"
},
"2" => {
"valueKey" : "2.1.1",
"valueDescription": "another thing"
},
"5" => {
"valueKey" : "5.1.1",
"valueDescription": "-1"
}
}
But something really strange happen and iterate_on "jumps" one of the values and I get nothing, not even the fallback value:
{
...,
"eventDataSplit" => {
"1" => {
"valueKey" : "1.1.1",
"valueDescription": "one thing"
},
"2" => {
"valueKey" : "2.1.1",
"valueDescription": "another thing"
},
"5" => {
"valueKey" : "5.1.1"
}
}
I don't know if all this json and csv thing was needed, but I really need some help. Am I doing something wrong?
Currently using logstash 7.8.1
Thanks