Logstash: How to replace field values in JSON based on ID

Hello
How to replace all occurrences of ID in such JSON:
"_source": {
"rules": [
{
"ruleID": "001"
"action": "count"
}
{
"ruleID": "003"
"action": "count"
}
]
}

Provided that all identifiers are known:
001 - Rule_name_1
002 - Rule_name_2
003 - Rule_name_3

The result should be like this:
"_source": {
"rules": [
{
"ruleID": "Rule_name_1"
"action": "count"
}
{
"ruleID": "Rule_name_3"
"action": "count"
}
]
}

Use the iterate_on option on a translate filter

translate {
    dictionary => { "001" => "Rule_name_1" "002" => "Rule_name_2" "003" => "Rule_name_3" }
    iterate_on => "rules"
    field => "ruleID"
}
2 Likes

Thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.