LogStash:: How To Add a New Field, Then Populate It Based On Another Field's Value?

Elastic Stack Logstash
15

Yes! You are right! That worked! I can see my new field in Logstash's output, plus in Kibana too. I'm so good, this is most excellent indeed! Thank you!

I will repost the final solution below, for the benefit of anyone who may be reading this post.

So to add a "name" field into my data based on the value of A.AA.product_code (where the data's structure is as described above), I modified my LS config file with the following:

filter {
  translate {
    field => "[A][AA][product_code]"
    destination => "name"
    dictionary_path => "/home/me/myNameList.yaml"
    fallback => "unknown"
    refresh_interval => 60
    refresh_behaviour => replace
  }
}

And where the /home/me/myNameList.yaml looks like this:

"100": apples
"200": oranges
"300": bananas

This instructs LG to examine every value of A.AA.product_code and do its best to match that value against the strings listed in the myNameList.yaml file. If no value can be found, LS populates the new "name" field with the string "unknown"

Thanks again Badger! You rock!