Logstash Grok And Translate

Elastic Stack Logstash
1

Hi All,

I'd like to use translate to look for a pattern in a file.
Once i have the pattern in field i'd like to use this field as a pattern in my grok but it doesn't seems to work properly.

I explain, i have a YAML file with two columns :

1: "%{WORD:field1};%{WORD:FIELD2}"
...

My conf logstash is like that :

input{
....
}

filter {

grok { "message" => "%{WORD:key}" }

translate { 
                 dictionary_path => "path_to_my_yaml_file"
                 field => "key"
                 destination => "myGrokPattern"
                 }

grok { "message" => "myGrokPattern" } 

}

output { .... }

Is it possible to do this way ? do you know how to do that ?

Thanks a lot.

2

Try %{myGrokPattern} instead. But I am not so sure it will work anyway, as the grok filter will look for the pattern in it's library, not take it from the message.