# Logstash - event id to name

**URL:** <https://discuss.elastic.co/t/logstash-event-id-to-name/126348>\
**Category:** Logstash\
**Created:** [April 1, 2018, 10:30am UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348 "2018-04-01T10:30:50Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [April 1, 2018, 10:30am UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/1 "2018-04-01T10:30:51Z")

</div>

Hi All,

Am trying to add another field in elasticsearch from the winlogbeat the event id to tier corresponding names but I couldn't execute it

```auto
filter {

 if "Security" in [log_name] {

  translate {

   dictionary => [ "4624", "Successful logon",

           "4647", "User initiated logoff",

           "4648", "Account login with Explicit Credentials" ]

   field => "[event_id]"

   destination => "[event_id][Name]"

   add_tag => ['Event_Name_translate']

   exact => false
    }
 }
}

```

Am getting this error .  
[2018-03-29T14:03:42,298][ERROR][logstash.filters.translate] Something went wrong when attempting to translate from dictionary {:exception=\>java.lang.ClassCastException, :field=\>"[event\_id]", :event=\>#LogStash::Event:0x400fd3b8}

[2018-03-29T14:03:42,298][ERROR][logstash.filters.translate] Something went wrong when attempting to translate from dictionary {:exception=\>java.lang.ClassCastException, :field=\>"[event\_id]", :event=\>#LogStash::Event:0x4c8f06b9}

[2018-03-29T14:03:42,298][ERROR][logstash.filters.translate] Something went wrong when attempting to translate from dictionary {:exception=\>java.lang.ClassCastException, :field=\>"[event\_id]", :event=\>#LogStash::Event:0x4fc69633}

Please do help me to find it out

Thanks,  
Raj

---

<div class="post-metadata">

**Author:** ![paano](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@paano](https://discuss.elastic.co/u/paano)\
**Post date:** [April 1, 2018, 3:00pm UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/2 "2018-04-01T15:00:18Z")

</div>

try `field => [fields][event_id]`

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [April 1, 2018, 6:54pm UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/3 "2018-04-01T18:54:23Z")

</div>

Thank you now there is no error ,but there is no field added in elasticsearch and i refreshed the kibana fields ,still its not added.Am not sure what could be the problem.Even i receive couple of event ids 4624, 4647 etc..

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [April 2, 2018, 4:15am UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/4 "2018-04-02T04:15:47Z")

</div>

This is incorrect. The way that Raj had done it earlier was the correct way.

Did you have a look at this thread? Might give you some idea. I have not used the translate often, but given that it is a dictionary, the syntax should ideally be [field\_name][attribbute\_name].

> [@Translate filter not working](https://discuss.elastic.co/t/translate-filter-not-working/87505):
>
> Hi, I'm using the translation filter to look up some values. This works but the issue I'm running into is that I want to keep the original field untouched so I need to copy the field and replace the value in the new field with the dictionary file value if an entry exists or otherwise keep the original value. I'm trying to use an IF statement to check if the field exists and surely this works, if the field exists a new field with the same value is created. But for some reason when using the IF…

Also, if you could post the entire filter it would be helpful.

Do you need the field to be a nested field? Why can't you create a new field called `event_id_name` and use it instead?

[https://qbox.io/blog/logstash-translate-filter-intro](https://qbox.io/blog/logstash-translate-filter-intro)

Regards,  
N

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [April 2, 2018, 12:00pm UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/5 "2018-04-02T12:00:09Z")

</div>

Thank you for the reply,Actually am trying to recreate something like this , I have another filter which works fine

Working one

```auto
input {
  beats {
    port => 5044
  }
}

filter {
  if "AccessList" in [event_data] {
    translate {
      dictionary => [ '%%1537', "Delete",
                      '%%1538', "ReadControl",
                      '%%1539', "ReadControl",
                      '%%1805', "NotGranted" ]
      field => "[event_data][AccessList]"
      destination => "[event_data][Accesses]"
      add_tag => ['accesses_translate']
      exact => false
    }
  }
}

```

Non working one ,same input but different filter

```auto
filter {
  if "Security" in [log_name] {
    translate {
      dictionary => [ '4624', "Successful logon",
                      '4647', "User initiated logoff",
                       '4648', "Account login with Explicit Credentials" ]
      field => "[event_id]"
      destination => "[event_id][Name]"
      add_tag => ['Event_Name_translate']
      exact => false
    }
  }  
}

```

even tried with double quotes "4624" ,still same error

Thanks,  
Raj

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 2, 2018, 1:33pm UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/6 "2018-04-02T13:33:55Z")

</div>

Please show us the event, either from output { stdout { codec =\> rubydebug } } or from the JSON tab in the Discover panel in Kibana.

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [April 2, 2018, 3:28pm UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/7 "2018-04-02T15:28:07Z")

</div>

Hi Badger,

This how it looks like

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a7633ca8fca9f87454bee492bf3fb007cccab46b.png)

```auto
{
  
"_index": "winlogbeat-2018.04.02",
 
 "_type": "doc",
 
 "_id": "JdrxGLa3J",
 
 "_version": 1,
  
"_score": null,
 
 "_source": {
    "computer_name": "Det.k",
    "process_id": 540,
    "keywords": [
      "Audit Success"
    ],
    "log_name": "Security",
    "level": "Information",
    "record_number": "854127",
    "event_data": {
      "ProcessName": "-",
      "LogonGuid": "{000000-0000-0000-0000-000000000}",
      "LogonType": "3",
      "IpPort": "54579",
      "TransmittedServices": "-",
      "SubjectLogonId": "0x0",
      "KeyLength": "128",
      "LmPackageName": "NTLM V2",
      "TargetLogonId": "0x1028a",
      "SubjectUserName": "-",
      "WorkstationName": "V40",
      "IpAddress": "x.x.x.x",
      "SubjectDomainName": "-",
      "ProcessId": "0x0",
      "TargetUserName": "trnc",
      "TargetDomainName": "Vrf",
      "LogonProcessName": "NtL",
      "SubjectUserSid": "1-3-0-0",
      "TargetUserSid": "S-114293-160-60-257",
      "AuthenticationPackageName": "Neg"
    },
    "message": "An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Type:\t\t\t3\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-128-198-600-257\n\tAccount Name:\t\t\n\tAccount Domain:\t\tV\n\tLogon ID:\t\t0x118a\n\tLogon GUID:\t\t{00000000-0000-0000-0000-00000000}\n\nProcess Information:\n\tProcess ID:\t\t0x0\n\tProcess Name:\t\t-\n\nNetwork Information:\n\tWorkstation Name:\t-AP0\n\tSource Network Address:\t10.11.29.143\n\tSource Port:\t\t54579\n\nDetailed Authentication Information:\n\tLogon Process:\t\tNtLmSsp \n\tAuthentication Package:\tNTLM\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\tNTLM V2\n\tKey Length:\t\t128\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.",
    "type": "wineventlog",
    "opcode": "Info",
    "tags": [
      "beats_input_codec_plain_applied"
    ],
    "thread_id": 42,
    "@timestamp": "2018-04-02T15:24:13.439Z",
    "event_id": 4624,
    "task": "Logon",
    "provider_guid": "{545-578-494-AA-3BC}",
    "@version": "1",
    "beat": {
      "name": "VC19",
      "hostname": "V19",
      "version": "6.0.1"
    },
    "host": "V9",
    "source_name": "Microsoft-Windows-Security-Auditing"
  },
  "fields": {
    "@timestamp": [
      "2018-04-02T15:24:13.439Z"
    ]
  },
  "sort": [
    1522682653439
  ]
}

```

Thanks,  
Raj

---

<div class="post-metadata">

**Author:** ![Suman\_Reddy1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suman_reddy1/32/27303_2.png) [@Suman\_Reddy1](https://discuss.elastic.co/u/Suman_Reddy1)\
**Post date:** [April 2, 2018, 3:43pm UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/8 "2018-04-02T15:43:00Z")

</div>

Try changing  
`destination => "[event_id][Name]" ==> destination => "dummyName"`

I am not that familiar with translate but destination something I used.

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 2, 2018, 4:27pm UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/9 "2018-04-02T16:27:33Z")

</div>

Two problems

1. The use of exact =\> false with a numeric field.
2. Trying to create a field within a numeric field.

The following works

```auto
input { generator { message => '{ "event_id" : "1234624789" } ' count => 1 } }
output { stdout { codec => rubydebug } }
filter { json { source => "message" } }
filter {
  translate {

    dictionary => [ "4624", "Successful logon",
                    "4647", "User initiated logoff",
                    "4648", "Account login with Explicit Credentials" ]
    field => "[event_id]"
    destination => "[foo][Name]"
    add_tag => ['Event_Name_translate']
    exact => false
  }
}

```

and results in

```auto
           "foo" => {
        "Name" => "123Successful logon789"
    }

```

So choose a new destination and also either mutate+copy event\_id to another field then mutate+convert it to a string, or remove exact =\> false.

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [April 2, 2018, 5:11pm UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/10 "2018-04-02T17:11:21Z")

</div>

Hi Badger,

Thank you for the reply ,so do you mean this will work

```auto
filter {
  translate {
dictionary => [ "4624", "Successful logon",
                    "4647", "User initiated logoff",
                    "4648", "Account login with Explicit Credentials" ]
    field => "[event_id]"
    destination => "[Eventid][Name]"
    add_tag => ['Event_Name_translate']
  }
}

```

Thanks,  
Raj

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 2, 2018, 5:19pm UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/11 "2018-04-02T17:19:21Z")

</div>

> [@Raj\_Kumar](#):
>
> so do you mean this will work

I believe so.

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [April 3, 2018, 7:42am UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/12 "2018-04-03T07:42:22Z")

</div>

Thank you for the reply, i will try it out

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2018, 7:42am UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/13 "2018-05-01T07:42:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.