Logstash link fileds in aggregate filter

I would use a translate filter rather than aggregate. You will need to be able to extract the country code from the phone number. There is code that can do that here. (You cannot use that directly, obviously, but it shows you all the logic required.)

Then if you have a csv (or yml, or json) that contains codes and names, like this

252,Somalia
961,Lebanon
51,Peru

translate will map it for you.