Logstash translate plugin

Elastic Stack Logstash
#1

with the translate plugin, are the fields in the dictionary a strict/exact match, or will a "contains" also match?

so if my yaml file had something like:

"blah.com" : "true"

would a log line with www.blah.com also match? if not can I do something like *.blah.com in the yaml file?

#2

As this is a Logstash question rather than an ES question I suggest you edit your post and change the category to Logstash.

As for your question, have a look at the translate filter's regex option.

#3

ah, thanks. its been a long day! :slight_smile:

i've tried; "\.blah\.com": "true" but its not giving me the results i expect.. is there any documentation on what the regex should look like?

i've also tried "/(?i)\.blah\.com$": "true", however it complains about the first . being an unknown escape character?

#4