# Refactoring logstash config

**URL:** https://discuss.elastic.co/t/refactoring-logstash-config/80502
**Category:** Logstash
**Created:** [March 29, 2017, 3:01pm UTC](https://discuss.elastic.co/t/refactoring-logstash-config/80502 "2017-03-29T15:01:43Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![rahul.dhammy](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rahul.dhammy](https://discuss.elastic.co/u/rahul.dhammy)
#### Post date: [March 29, 2017, 3:01pm UTC](https://discuss.elastic.co/t/refactoring-logstash-config/80502/1 "2017-03-29T15:01:43Z")

</div>

Being a OO developer and focusing on code maintainability and quality, I want to know is there way I can make my logstash config a bit nicer. For instance below is my config file and I hate to see those if statements. Also would be great if I can uses key-value dictionary for these if statements, use constants etc.

filter  
{  
if [machine]=="machineNameA"  
{  
mutate{  
add\_field =\> ["ServerName","dev-alias-01"]  
}  
}  
if [machine]=="machineNameB"  
{  
mutate{  
add\_field =\> ["ServerName","dev-alias-02"]  
}  
}  
if [machine]=="machineNameC"  
{  
mutate{  
add\_field =\> ["ServerName","QA-alias-01"]  
}  
}  
if [machine]=="machineNameD"  
{  
mutate{  
add\_field =\> ["ServerName","QA-alias-02"]  
}  
}  
if [machine]=="machineNameE"  
{  
mutate{  
add\_field =\> ["ServerName","UAT-alias-01"]  
}  
}  
if [machine]=="machineNameF"  
{  
mutate{  
add\_field =\> ["ServerName","UAT-alias-02]  
}  
}  
}

---

<div class="post-metadata">

### Author: ![Jayanna\_Hallur](https://avatars.discourse-cdn.com/v4/letter/j/a4c791/32.png) [@Jayanna\_Hallur](https://discuss.elastic.co/u/Jayanna_Hallur)
#### Post date: [March 29, 2017, 3:07pm UTC](https://discuss.elastic.co/t/refactoring-logstash-config/80502/2 "2017-03-29T15:07:42Z")

</div>

I too have similar question..

---

<div class="post-metadata">

### Author: ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [March 29, 2017, 3:15pm UTC](https://discuss.elastic.co/t/refactoring-logstash-config/80502/3 "2017-03-29T15:15:08Z")

</div>

A very quick and easy alternative would be using the translate filter, like so

`
filter {
    translate {
        field => "machine"
        exact => true
        dictionary_path => "/path/to/file.yml"
        destination => "ServerName"
    }
}`

With a yaml file similar to below

```auto
"machineNameA": "dev-alias-01"
"machineNameB": "dev-alias-02"
```

Then you'd only need to maintain the external yaml file if it needs to be changed.

Edit: You can also use an inline kv pair inside the translate filter, but that a) looks bloated the higher the kv amount, and b) is not as easily maintainable as you'd need to alter the configuration itself and not plainly refresh an external file.

---

<div class="post-metadata">

### Author: ![rahul.dhammy](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rahul.dhammy](https://discuss.elastic.co/u/rahul.dhammy)
#### Post date: [March 29, 2017, 3:20pm UTC](https://discuss.elastic.co/t/refactoring-logstash-config/80502/5 "2017-03-29T15:20:53Z")

</div>

> [@rahul.dhammy](#):
>
> This sounds helpful. It would at least replace the nasty if statement.Thanks!

This sounds helpful. It would at least replace the nasty if statement.  
Thanks!

---

<div class="post-metadata">

### Author: ![rahul.dhammy](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rahul.dhammy](https://discuss.elastic.co/u/rahul.dhammy)
#### Post date: [March 29, 2017, 7:41pm UTC](https://discuss.elastic.co/t/refactoring-logstash-config/80502/6 "2017-03-29T19:41:35Z")

</div>

Hi any more ideas for this. I am facing 2 issues here

1. Logstash gives error plugin "filter" not available.
2. When I try to download that using-plugin install logstash-filter-translate, I get error "connection refused". I think this is happening because my server is behind a proxy. There is no simple process for me to bypass all this or get this installed.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 30, 2017, 5:34am UTC](https://discuss.elastic.co/t/refactoring-logstash-config/80502/7 "2017-03-30T05:34:46Z")

</div>

> When I try to download that using-plugin install logstash-filter-translate, I get error "connection refused". I think this is happening because my server is behind a proxy. There is no simple process for me to bypass all this or get this installed.

> **[Working with plugins | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/working-with-plugins.html#proxy-plugins)**

---

<div class="post-metadata">

### Author: ![rahul.dhammy](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rahul.dhammy](https://discuss.elastic.co/u/rahul.dhammy)
#### Post date: [March 30, 2017, 3:16pm UTC](https://discuss.elastic.co/t/refactoring-logstash-config/80502/8 "2017-03-30T15:16:37Z")

</div>

Thanks I will try this and keep you posted.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 27, 2017, 3:16pm UTC](https://discuss.elastic.co/t/refactoring-logstash-config/80502/9 "2017-04-27T15:16:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
