# Logstash - event id to name

**URL:** https://discuss.elastic.co/t/logstash-event-id-to-name/126348
**Category:** Logstash
**Created:** [April 1, 2018, 10:30am UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348 "2018-04-01T10:30:50Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)
#### Post date: [April 2, 2018, 4:15am UTC](https://discuss.elastic.co/t/logstash-event-id-to-name/126348/4 "2018-04-02T04:15:47Z")

</div>

This is incorrect. The way that Raj had done it earlier was the correct way.

Did you have a look at this thread? Might give you some idea. I have not used the translate often, but given that it is a dictionary, the syntax should ideally be [field\_name][attribbute\_name].

> [@Translate filter not working](https://discuss.elastic.co/t/translate-filter-not-working/87505):
>
> Hi, I'm using the translation filter to look up some values. This works but the issue I'm running into is that I want to keep the original field untouched so I need to copy the field and replace the value in the new field with the dictionary file value if an entry exists or otherwise keep the original value. I'm trying to use an IF statement to check if the field exists and surely this works, if the field exists a new field with the same value is created. But for some reason when using the IF…

Also, if you could post the entire filter it would be helpful.

Do you need the field to be a nested field? Why can't you create a new field called `event_id_name` and use it instead?

[https://qbox.io/blog/logstash-translate-filter-intro](https://qbox.io/blog/logstash-translate-filter-intro)

Regards,  
N

---

_[View the full topic](https://discuss.elastic.co/t/logstash-event-id-to-name/126348)._