My translate plugin doesn't seem to work with a dictionary file

Elastic Stack Logstash
1

I can't explain why this doesn't work, and it's really irking me, hoping someone could take a look and help me out.

        mutate {
		add_field => [ "dictionary_lookup", "%{host} %{sitename}" ]
		}
		
	translate {
		field => "dictionary_lookup"
		destination => "sc_sitename"			
		#dictionary => ["Server W3SVC2","Logstash"]
		dictionary_path => "E:/ELK/logstash/dictionaries/dictionary.yaml"
		}

My .yaml file is in the proper location, and contains a single line containing:

"Server W3SVC2": "Logstash"

When I flip my comment from dictionary to dictionary_path, the code works instantly. My field dictionary lookup contains the value "Server W3SVC2" and the translation occurs, storing the name Logstash in the sc_sitename column. Can anyone tell what I'm doing wrong with the dictionary_path that's causing this to fail? Thanks in advance.

2

If you launch logstash with --debug do you see some output or errors from the translate filter?

If the filter was not able to find a file logstash would refuse to start.
What is the encoding of the yaml file? utf8?

On macos with a simple configuration file and when I type "Server W3SVC" it correctly create the field.

input {
  stdin {}
}
filter {
  translate {
    field => "message"
    destination => "Hola"
    dictionary_path => "/tmp/translate.yml"
  }
}

output {
  stdout { codec => rubydebug {} }
}

And the following translate.yml

"Server W3SVC2": "Logstash"
3

It ended up being the encoding of the file. I was using notepad++ to edit my yaml file and it was adding tabs, spaces, or something that I couldn't see. When I changed to sublime it worked right away. Thanks for the suggestion on starting in debug, I will try that next time I run into an error.