Logstash Translate filter plugin based on multilevel dictionary

Elastic Stack Logstash
1

Assuming we have a dictionary with nested structure (YAML):

"key1":
  "sub-key1": "value1"
  "sub-key2": "value2"
  "sub-key3": "value3"
"key2":
  "sub-key4": "value4"
  "sub-key5": "value5"
  "sub-key6": "value6"

Currently, the below translate plugin configuration gives an object with all "sub-key"s as translated value:

 translate {
    source     => "[field1]"
    target     => "[translatedField]"
    dictionary_path   => "/path/to/dictionary.yaml"
  }

The equivalent phrase of "sub-key1" is in another event field (i.e. field2). However I couldn't utilize it with something like source => "[field1][%{field2}]" or source => "[field1][field2] in translate plugin.

Current result:

"translatedField" => {
    "sub-key1" => "value1"
    "sub-key2" => "value2"
    "sub-key3" => "value3"
}

while the desired result is:

"translatedField" => "value1"

What's the efficient way to access the values as the final translation? (preferably with just one translate plugin usage).
A workaround would be making a flatted dictionary with the "key" prefixed to all sub-keys and then using a temporary field for source like this (source):

translate {
    add_field => { "lookup" => "%{field1}_%{field2}" }
    source => "lookup"
    target => "translatedField"
    dictionary_path => "/path/to/dictionary.yaml"
    remove_field =>  [ "lookup" ]
}

Anyway, the above config won't work apparently; because add_field acts when the translate filter is successful (according to documentation) so add_field should be used in a previous filter. After all, I'm looking for a more elegant way.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.