# Logstash filter based on reference set or database

**URL:** <https://discuss.elastic.co/t/logstash-filter-based-on-reference-set-or-database/274302>\
**Category:** Logstash\
**Created:** [May 28, 2021, 8:19am UTC](https://discuss.elastic.co/t/logstash-filter-based-on-reference-set-or-database/274302 "2021-05-28T08:19:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![redfish462](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redfish462/32/88654_2.png) [@redfish462](https://discuss.elastic.co/u/redfish462)\
**Post date:** [May 28, 2021, 8:19am UTC](https://discuss.elastic.co/t/logstash-filter-based-on-reference-set-or-database/274302/1 "2021-05-28T08:19:40Z")

</div>

Hello,

I have to redirect some logs based on their username (the usernames are contains in the logs) to different outputs. This list has 80 entry, so it's a lot to write this in the configuration file.

I would like to know if I can base an "if" based on a file or a database (elastic, sql, whatever) and logstash will retrieve the list to apply the filter. I didn't find it in the documentation so if you have any link 😄

Thank you

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 28, 2021, 4:36pm UTC](https://discuss.elastic.co/t/logstash-filter-based-on-reference-set-or-database/274302/2 "2021-05-28T16:36:43Z")

</div>

You can use a [translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) filter to match the usernames, then use a conditional based on the fallback option to determine whether it matched, or if different usernames need to go to different outputs use a translate filter to determine that.

---

<div class="post-metadata">

**Author:** ![redfish462](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redfish462/32/88654_2.png) [@redfish462](https://discuss.elastic.co/u/redfish462)\
**Post date:** [May 28, 2021, 7:18pm UTC](https://discuss.elastic.co/t/logstash-filter-based-on-reference-set-or-database/274302/3 "2021-05-28T19:18:05Z")

</div>

Is the elasticsearch filter plugin is not better to do this thing ? With the translate plugin I have to write all the 80 things into the configuration file .... [Elasticsearch filter plugin | Logstash Reference [7.13] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 28, 2021, 8:07pm UTC](https://discuss.elastic.co/t/logstash-filter-based-on-reference-set-or-database/274302/4 "2021-05-28T20:07:16Z")

</div>

> [@redfish462](#):
>
> Is the elasticsearch filter plugin is not better to do this thing ?

That's another option, as is a jdbc\_static filter or a memcached filter. There are many ways to do the lookup.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2021, 8:08pm UTC](https://discuss.elastic.co/t/logstash-filter-based-on-reference-set-or-database/274302/5 "2021-06-25T20:08:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.