Logstash link fileds in aggregate filter

[fedwe (fedwe khoury)]

I have 2 files one that contains the filed number for example 961123456
and the other file cointains : country_code 961 country name x

can i use the aggregate filter to link the 2 fields to the number filed when indexing

cause i want to substring the number and return the code of it and the country in the same data table

[Badger]

I would use a translate filter rather than aggregate. You will need to be able to extract the country code from the phone number. There is code that can do that here. (You cannot use that directly, obviously, but it shows you all the logic required.)

Then if you have a csv (or yml, or json) that contains codes and names, like this

252,Somalia
961,Lebanon
51,Peru

translate will map it for you.