Logstash - event id to name

This is incorrect. The way that Raj had done it earlier was the correct way.

Did you have a look at this thread? Might give you some idea. I have not used the translate often, but given that it is a dictionary, the syntax should ideally be [field_name][attribbute_name].

Also, if you could post the entire filter it would be helpful.

Do you need the field to be a nested field? Why can't you create a new field called event_id_name and use it instead?

https://qbox.io/blog/logstash-translate-filter-intro

Regards,
N

1 Like