Hi All, I need some help. I am trying to use a translate filter in logstash to translate winlog.event_data.AccessList value to some meaningful field but it's not working. below is my code in the filter file.
Looks like this if statement "if "AccessList" in [event_date]" is not working. I tried [winlog][even_data] and
[winlog.event_data] but still doesn't work.
filter {
if "fileserver" in [tags] {
if "AccessList" in [event_data] {
mutate{
add_field => { "TestField" => "Testing" }
}
translate {
field => "AccessList"
destination => "Accesses"
exact => false
dictionary => [ '%%1537', "Delete",
'%%1538', "ReadControl",
'%%1539', "ReadControl",
'%%1540', "ReadControl",
'%%1541', "Synchronize",
'%%1542', "Synchronize",
'%%4416', "ReadData",
'%%4417', "WriteData",
'%%4418', "AppendData",
'%%4419', "ReadEA",
'%%4420', "WriteEA",
'%%4423', "ReadAttrib",
'%%4424', "WriteAttrib",
'%%1801', "Granted",
'%%1805', "NotGranted" ]
}
}
}
}