Logstash translate doesn't work

Elastic Stack Logstash
1

Hello,

I have the following code:

input {
  file {
    path => "/home/path/files/*.csv"
    start_position => "beginning"
  }
}

filter {
      csv {
        columns => [ "xx1","xx2","xx3","xx4","Response","TimeStamp","Username","xx5" ]
     }
        date {
                        match => [ "TimeStamp", "yyyyMMddHHmmss" ]
                        locale => "en"
                }
        translate {
                dictionary_path => "/home/mihai/prefixes_trimmed.csv"
                field => "xx4"
                destination => "name"
                fallback => "Unknown Name"
        }
    }

output {
  elasticsearch {
  hosts => ["localhost:9200"]
  index => "mihai"
  }
 }

The prefix is a substring of first 5 or 6 digits from xx4 field. I expect the variable "name" to contain the second column from prefixes_trimmed.csv, if a prefix match is made.

When tested, nothing is happening, no data is inserted.

Can you please help me with the correct translate sentence to make this work?

Best Regards,
Mihai Radulescu

2

A translate filter does not match prefixes, it does exact matches by default. If you can modify the csv then the regex option to the filter may be useful.

3

Hi Badger,
Thanks for the answer.
I think I managed to get around that.
I have another question now. How do I make multiple translations?
Best Regards,
Mihai Radulescu

4

Hi,
I managed to make it working like this:

filter {
        translate {
...
        }

        translate {
...
        }
}

Best Regards,

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.