Regex not working for translate filter

Elastic Stack Logstash
1

Hi,

I'm trying to add a translate filter to parse a field using regex and populate a destination based on the value. If it is a direct text match it is working fine. But with regex it is always going to fallback value.

I'm trying to match the following packages with the translate filter.
com.xxx.flowapi.abc
com.xxx.prs.abc

Here is the code snippet. If I use the complete package name it works but if I use regex as below it always goes to the fallback value. Am I missing something here?

translate {  
    regex => true
    field => "package"
    destination => "subtype"
    fallback => "unknown_subtype"
    dictionary => [ "/prs/", "prs",
        "/flowapi/", "dwflowapi"
    ]
}

Regards,
Bharath

2

I'm pretty sure you're not supposed to surround your regular expression with slashes.

3

From the translate plugin documentation:

If you’d like to treat dictionary keys as regular expressions, set exact => true. Note: this is activated only when exact => true.

Worked for me.