# Logstash array how to and filter

**URL:** https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054
**Category:** Logstash
**Created:** [February 23, 2022, 3:26pm UTC](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054 "2022-02-23T15:26:38Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![melorium](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/melorium/32/100710_2.png) [@melorium](https://discuss.elastic.co/u/melorium)
#### Post date: [February 23, 2022, 3:26pm UTC](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054/1 "2022-02-23T15:26:39Z")

</div>

![Skärmavbild 2022-02-23 kl. 16.21.24](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2e0d29e39ff21d5fad4e1b4f735c93f3da15a153.png)

Hi. I have a list of user name's with user ID 1-100 each user id case a name that contains to it.

Exmaple 01 "user 1" 02 "user2" etc.

I my log events I have user id known but not user name.

How can I match user id with a list of 100 names?

csv file look like this

1 , user 1  
2, user 2  
3, user 3 etc etc.

So let say I have user id 63 and I want to match it from that list.

Can I use an array or match hasch?

I can use 100 if but I dont want that.

Thanks a lot for you help.

Dennis

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 23, 2022, 3:28pm UTC](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054/2 "2022-02-23T15:28:25Z")

</div>

A [translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) filter might work.

---

<div class="post-metadata">

### Author: ![melorium](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/melorium/32/100710_2.png) [@melorium](https://discuss.elastic.co/u/melorium)
#### Post date: [February 23, 2022, 3:58pm UTC](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054/3 "2022-02-23T15:58:12Z")

</div>

Du you have an example?

All log events I have user ID and I have a CSV file as I told you.

So I want to compare that id to a list from a CSV and add a field with user name.

 ![Skärmavbild 2022-02-23 kl. 16.57.58](https://us1.discourse-cdn.com/elastic/original/3X/d/f/dfdf480861a8e4b3ab125ccc643c6924cee2badb.png)

---

<div class="post-metadata">

### Author: ![melorium](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/melorium/32/100710_2.png) [@melorium](https://discuss.elastic.co/u/melorium)
#### Post date: [February 23, 2022, 4:01pm UTC](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054/4 "2022-02-23T16:01:44Z")

</div>

csv look like this

user id, unername  
01, [example@domian.com](mailto:example@domian.com)  
02 [example2@domain.com](mailto:example2@domain.com)  
etc up to over 1000

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 23, 2022, 4:11pm UTC](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054/5 "2022-02-23T16:11:26Z")

</div>

> [@melorium](#):
>
> Du you have an example?

See [this](https://discuss.elastic.co/t/compare-a-field-with-a-csv-file-and-add-info-from-csv-in-a-new-field/191973/2) thread.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 23, 2022, 4:11pm UTC](https://discuss.elastic.co/t/logstash-array-how-to-and-filter/298054/6 "2022-03-23T16:11:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
