Hi - I am trying to create a dynamic dictionary_path for the translate function that will allow me to import IIS sitename values. As it stands right now, I have the following filter working:
translate{
dictionary_path => "E:/ELK/logstash/dictionaries/server01.yaml"
field => "sitename"
destination => "sc_sitename"
}
This works perfectly and gives me what I want, for the server01. The issue is the IIS logs sitename starts from 1 on each server, so the output of the field sitename is duplicated many times. What I want is to have the translate function dynamically use a .yaml file based on what the servers host name is.
What I've tried is something like:
dictionary_path => "E:/ELK/logstash/dictionaries/%{host}.yaml"
But that's causes the filter to break and the application to stop working. Can anyone point me in the right direction on how to get the functionality I'm looking for to work, without hard coding every possible combination?
