Logstash translate filter


(Harsh Jain) #1

I'm new to the Elastic stack and Logstash. I have a new Logstash instance that is accepting logs from beats sending to Elasticsearch. I am trying to apply translate filter based on regex keys. Here the key point to note is that I want replacement based on backreferences, i.e., replacement string must contain substring of searched string.

For e.g.
/abc/xyz/3rfd3ed32dedece has to be translated into /abc/xyz/. Here “/abc/xyz” may vary.

I have used dictonary (json) for applying translation.

Dictionary contains:
{
“^(\/[\w]*\/[\w]*\/).*$”: “$1”
}

I am not able to use backreferences in translate filter. Is it possible to use them. If yes, then how we can use it.


(Paris Mermigkas) #2

Sounds like you just want to grab a specific part of the value and skip the rest. Is that correct?
If so, I don't think the translate filter is the most suitable for that kind of operation. Some custom Ruby code would be far easier.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.