# Match against blacklist **URL:** \ **Category:** Logstash\ **Created:** [October 26, 2015, 2:59pm UTC](https://discuss.elastic.co/t/match-against-blacklist/32995 "2015-10-26T14:59:58Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![zappe](https://avatars.discourse-cdn.com/v4/letter/z/439d5e/32.png) [@zappe](https://discuss.elastic.co/u/zappe)\ **Post date:** [October 26, 2015, 2:59pm UTC](https://discuss.elastic.co/t/match-against-blacklist/32995/1 "2015-10-26T14:59:59Z")
I have DNS logs which I'd like to match against a blacklist. I've imported the dns logs via a grok filter. Can anyone point me in the right direction to match my parsed URL field with a blacklist in some way? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 26, 2015, 3:23pm UTC](https://discuss.elastic.co/t/match-against-blacklist/32995/2 "2015-10-26T15:23:41Z")
Perhaps the [translate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) can help? It allows you to look up and replace field values from an external dictionary file that's refreshed at regular (and configurable) intervals. I think it only does exact matches, though. ---
**Author:** ![zappe](https://avatars.discourse-cdn.com/v4/letter/z/439d5e/32.png) [@zappe](https://discuss.elastic.co/u/zappe)\ **Post date:** [October 27, 2015, 7:38am UTC](https://discuss.elastic.co/t/match-against-blacklist/32995/3 "2015-10-27T07:38:00Z")
Looks to be in the right direction, though there's no need to replace. Matching and adding a tag is enough, or not matching and drop. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 27, 2015, 7:45am UTC](https://discuss.elastic.co/t/match-against-blacklist/32995/4 "2015-10-27T07:45:02Z")
Sure, but you can implement match-and-tag or match-and-drop semantics using that filter. ---
**Author:** ![zappe](https://avatars.discourse-cdn.com/v4/letter/z/439d5e/32.png) [@zappe](https://discuss.elastic.co/u/zappe)\ **Post date:** [October 27, 2015, 8:50am UTC](https://discuss.elastic.co/t/match-against-blacklist/32995/5 "2015-10-27T08:50:56Z")
Okey, but wouldn't the filter still need something to be replaced to be successful? My dictionary (blacklist) only hold one "version". ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 27, 2015, 8:54am UTC](https://discuss.elastic.co/t/match-against-blacklist/32995/6 "2015-10-27T08:54:54Z")
Copy the hostname field (or whatever) to a new field. Have the translate filter translate that field to a a fixed string. Then check if the translated field is equal to that fixed string. ---
**Author:** ![zappe](https://avatars.discourse-cdn.com/v4/letter/z/439d5e/32.png) [@zappe](https://discuss.elastic.co/u/zappe)\ **Post date:** [October 27, 2015, 9:56am UTC](https://discuss.elastic.co/t/match-against-blacklist/32995/7 "2015-10-27T09:56:45Z")
Something like this? filter { translate { field =\> "URL" destination =\> "matched" dictionary =\> [ "blacklisted1.url", "Yes", "blacklisted2.url", "Yes", "blacklisted3.url", "Yes" ] } } And then use a YAML-file with "dictionary\_path" for a large blacklist? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 27, 2015, 2:29pm UTC](https://discuss.elastic.co/t/match-against-blacklist/32995/8 "2015-10-27T14:29:57Z")
Yeah, something like that should be fine. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/match-against-blacklist/32995/9 "2017-07-06T05:25:14Z")