Logstash Pipeline Translate Filter

May somebody help me to solve the following problem?

My index gets written into elasticsearch but the field host.name is not changed according the predefined dictionary.

Data gets ingested from a metricbeat v7.3.

input {
    pipeline { address => "metricbeat-ais" }
}

filter {
	translate {
		field => "host.name"
		destination => "host.name"
        override => "true"
        dictionary => {
            "host-001" => "COM"
            "host-002" => "AMS"
		    "host-003" => "WEB"
            "host-004" => "SQL"
        }
	}
}

output {
    ...
    }
}

Are you sure it has a period in the field name, or is it a nested field that you would refer to as [host][name] in logstash?

Can you try,
field => "host[name]"

field => "[host][name]"
destination => "host.name"

I rely on ECS.
Your feedback solved my problem:

field => "[host][name]"
destination => "[host][name]"

Thanks Badger!

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.