Logstash Pipeline Translate Filter

Elastic Stack Logstash
1

May somebody help me to solve the following problem?

My index gets written into elasticsearch but the field host.name is not changed according the predefined dictionary.

Data gets ingested from a metricbeat v7.3.

input {
    pipeline { address => "metricbeat-ais" }
}

filter {
	translate {
		field => "host.name"
		destination => "host.name"
        override => "true"
        dictionary => {
            "host-001" => "COM"
            "host-002" => "AMS"
		    "host-003" => "WEB"
            "host-004" => "SQL"
        }
	}
}

output {
    ...
    }
}
2

Are you sure it has a period in the field name, or is it a nested field that you would refer to as [host][name] in logstash?

3

Can you try,
field => "host[name]"

4

field => "[host][name]"
destination => "host.name"

5

I rely on ECS.
Your feedback solved my problem:

field => "[host][name]"
destination => "[host][name]"

Thanks Badger!

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.