Logstash Translate Filter Can't Convert String Into Hash Loading Dictionary

Hello,

May I please request your advice?
I am on Windows Server 2012 R2, Logstash 5.4.0.
I am enriching either SQL Server results or text (shown) via a dictionary YAML file.
However, the error is :
error=>"LogStash::Filters::Translate: can't convert String into Hash when loading dictionary file at E:\mylogstash\project\PROJECTFILE\cleaned_dict.yaml"}
[2017-11-09T08:20:15,080][ERROR][logstash.agent ] Pipeline aborted due to error {:exception=>#<RuntimeError: LogStash::Filters::Translate: can't convert String into Hash when loading diction
ary file at E:\mylogstash\project\PROJECTFILE\cleaned_dict.yaml>

The Logstash Config is

#Command to execute
#E:\logstash-5.4.0\bin\logstash -f "E:\mylogstash\ConfigFiles\PROJECT_location2a-csv.config" -r -l "E:\mylogstash\logs\sqlserver" --path.settings=/E:/logstash-5.4.0/config/ --path.data=E:/mylogstash/logs/sqlserver/PROJECT_location2-csv/ -log.level debug
input {
file {
path => "E:\mylogstash\project\PROJECTNAME\171108_Yesterday_results.txt"
type => "test"
start_position => "beginning"
sincedb_path => "NUL" #This is a bit different for windows
ignore_older => 0
}
}

If you want to add Filter you can add one

filter {
csv {
columns => ["MiniPC","Geo","Site","Campus","RoomType","RoomName","Status","Timestamp","OnlineDay","InAssetDB","Uptime_Pct"]
separator => " "
}
translate {
field => "MiniPC"
destination => "enriched_data" # Adding the data got from the dictionary file into another field -> "enriched_data"
dictionary_path => 'E:\mylogstash\project\PROJECTNAME\cleaned_dict.yaml'
}
mutate{
split => { "enriched_data" => "," } # Splitting the joined column into various fields "enriched_data" , the output will be
}
mutate{
rename => {"enriched_data[0]" => "AssetName"}
rename => {"enriched_data[1]" => "GeoCode"}
rename => {"enriched_data[2]" => "CountryCode"}
rename => {"enriched_data[3]" => "SiteCode"}
rename => {"enriched_data[4]" => "CampusCode"}
rename => {"enriched_data[4]" => "BuildingCode"}
rename => {"enriched_data[5]" => "Floor"}
rename => {"enriched_data[6]" => "RoomTypeName"}
rename => {"enriched_data[7]" => "RoomName"}
rename => {"enriched_data[8]" => "Status"}
rename => {"enriched_data[9]" => "isPrivate"}
rename => {"enriched_data[10]" => "isExecutive"}
}
}

output {
stdout { codec => rubydebug }
#stdout { codec => dots } #Progress tracking by dots
#elasticsearch {
#hosts => ["SERVERNAME:PORT"]
#user => "USERNAME"
#password => "PASSWORD"
#ssl => true
#cacert => 'E:/\mylogstash/\COMPANYcachain.pem' #This should be downloaded and path should be updated
#index => "elkpoc-<project_indexname>-%{+YYYY.MM.dd}"
#index => "INDEXNAME_test2"
#}

The txt files are: MINIPCNAME AMR OR AL Video Conference Room-B ROOMNAME Production 2017-11-08 08:35:00.000 Yes TRUE 96.2
MINIPCNAME AMR OR AL Conference Room-C ROOMNAME Production 2017-11-08 08:32:00.000 Yes TRUE 95.8
MINIPCNAME AMR OR AL Conference Room-B ROOMNAME Production 2017-11-08 08:34:00.000 Yes TRUE 95.8

Thank you in advance!

What does cleaned_dict.yaml look like? Format as preformatted text when posting.

Hello Magnus,

Thanks! As requested, first 3 rows of cleaned_dict as preformatted.
"IU-JF4-399":"AMR,US,OR,JF,JF4,3,Video Conference Room-B,JF4-399/Dungeon,Production,1,0"
"IU-JF5-MX":"AMR,US,OR,JF,JF5,1,Video Conference Room-B,EBC-JF5-199,Production,1,0"
"IU-RNB-399":"AMR,US,SC,MI,RNB,3,Video Conference Room-B,RNB-399,Production,1,1"

The first 3 rows of preformatted datafile txt files:
IU-AL3-299 AMR OR AL Video Conference Room-B OR-AL-AL3-299 Production 2017-11-08 08:35:00.000 Yes TRUE 96.2
IU-AL3-298 AMR OR AL Conference Room-C OR-AL-AL3-298 Production 2017-11-08 08:32:00.000 Yes TRUE 95.8
IU-AL3-3293 AMR OR AL Conference Room-B OR-AL-AL3-293 Production 2017-11-08 08:34:00.000 Yes TRUE 95.8

Cordially, CChamberlain

You didn't post them as preformatted text. There's a toolbar button for it. Never mind in this case.

It looks like Logstash has a problem loading your YAML file but it doesn't give any details about it. Perhaps you can try a super simple file like

a: b

and see what happens.

Hi Magnus,
Thank you for your prompt reply. The resolution was discovered to be a required space before and after the colon. Ex: "a" : "b"

I apologize the my preformatted text attempt was unsuccessful.
I will become more familiar posting to Discuss.
Cordially, CChamberlain [/quote]

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.