# Logstash match value form external file **URL:** \ **Category:** Logstash\ **Created:** [June 4, 2018, 7:13am UTC](https://discuss.elastic.co/t/logstash-match-value-form-external-file/134367 "2018-06-04T07:13:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Md\_Ghulam\_khaja](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@Md\_Ghulam\_khaja](https://discuss.elastic.co/u/Md_Ghulam_khaja)\ **Post date:** [June 4, 2018, 7:13am UTC](https://discuss.elastic.co/t/logstash-match-value-form-external-file/134367/1 "2018-06-04T07:13:58Z")
I want to filter out logs which contains specific IP mapped from external file. DefaultUdpTransportMapping@182e8b8peerAddress=192.168.4.x, processed=false I have a txt file which contains list of IP line by line. I want to match these against the received logs. lets say 192.168.4.x 192.168.10.x 192.168.15.x How I can achieve this in logstash? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 4, 2018, 5:11pm UTC](https://discuss.elastic.co/t/logstash-match-value-form-external-file/134367/2 "2018-06-04T17:11:10Z")
Use a translate filter. ---
**Author:** ![Md\_Ghulam\_khaja](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@Md\_Ghulam\_khaja](https://discuss.elastic.co/u/Md_Ghulam_khaja)\ **Post date:** [June 7, 2018, 7:46am UTC](https://discuss.elastic.co/t/logstash-match-value-form-external-file/134367/3 "2018-06-07T07:46:01Z")
Hey Magnus, Translate filter is to translate matched value from dictionary. My requirement is based on match I want to output to kafka. So If IP match is success output log to kafka. Can you please explain how comparison works on Translate filter? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 7, 2018, 9:40am UTC](https://discuss.elastic.co/t/logstash-match-value-form-external-file/134367/4 "2018-06-07T09:40:21Z")
The translate filter lets you set a field value based on the presence of, in your case, an IP address. Then use that field value in a conditional around your kafka output. ---
**Author:** ![Md\_Ghulam\_khaja](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@Md\_Ghulam\_khaja](https://discuss.elastic.co/u/Md_Ghulam_khaja)\ **Post date:** [June 7, 2018, 10:16am UTC](https://discuss.elastic.co/t/logstash-match-value-form-external-file/134367/5 "2018-06-07T10:16:17Z")
Thanks Magnus, I did the same before seeing your reply. I put a check in output filter before pushing to Kafka. Thanks again ---
**Author:** ![Md\_Ghulam\_khaja](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@Md\_Ghulam\_khaja](https://discuss.elastic.co/u/Md_Ghulam_khaja)\ **Post date:** [June 7, 2018, 10:18am UTC](https://discuss.elastic.co/t/logstash-match-value-form-external-file/134367/6 "2018-06-07T10:18:02Z")
Do you have any workaround for refresh\_interval not working in translate filter? ---
**Author:** ![Md\_Ghulam\_khaja](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@Md\_Ghulam\_khaja](https://discuss.elastic.co/u/Md_Ghulam_khaja)\ **Post date:** [June 7, 2018, 10:42am UTC](https://discuss.elastic.co/t/logstash-match-value-form-external-file/134367/7 "2018-06-07T10:42:11Z")
figured it out. Now refresh interval is working as expected. Thanks Magnus for your valuable and clear cut reply. You know, You are awsome..🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2018, 10:42am UTC](https://discuss.elastic.co/t/logstash-match-value-form-external-file/134367/8 "2018-07-05T10:42:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.