# Replace values with predefined mapping with ELK

**URL:** https://discuss.elastic.co/t/replace-values-with-predefined-mapping-with-elk/22316
**Category:** Elasticsearch
**Created:** [February 22, 2015, 7:01pm UTC](https://discuss.elastic.co/t/replace-values-with-predefined-mapping-with-elk/22316 "2015-02-22T19:01:48Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Lucia\_Pasarin](https://avatars.discourse-cdn.com/v4/letter/l/b77776/32.png) [@Lucia\_Pasarin](https://discuss.elastic.co/u/Lucia_Pasarin)
#### Post date: [February 22, 2015, 7:01pm UTC](https://discuss.elastic.co/t/replace-values-with-predefined-mapping-with-elk/22316/1 "2015-02-22T19:01:48Z")

</div>

Hello! This is a question I posted on StackOverflow  
([http://stackoverflow.com/questions/28644501/replace-values-with-predefined-mapping-with-elk](http://stackoverflow.com/questions/28644501/replace-values-with-predefined-mapping-with-elk))  
for which I didn't get any answer yet:

I have a file that I read with Logstash containing a certain parameter  
called type. The possible values for this parameter are 0,1,2,3,4,5 (it is  
actually represented as an Enum in my Java code).

Let's say type 0 means book, type 1 means newspaper, type 2 means magazine,  
etc.

Currently my Logstash filter writes this parameter directly as the number,  
but I would like to display panels on Kibana Dashboards that would show me  
the value (e.g. book) instead of the number (i.e. 0).

Is there any possibility to add replacements or mappings to a list of  
predefined values at Kibana level? Or should I do this mapping manually at  
Logstash level with ifconditions? What would be the best approach?

Thanks for your help in advance!

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/8d4ed42d-93a3-45b7-b28e-377c9ddff2f1%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8d4ed42d-93a3-45b7-b28e-377c9ddff2f1%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 22, 2015, 8:35pm UTC](https://discuss.elastic.co/t/replace-values-with-predefined-mapping-with-elk/22316/2 "2015-02-22T20:35:08Z")

</div>

You're best off doing this in Logstash -

> **[Translate filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html)**

On 23 February 2015 at 06:01, Lucía Pasarin [lupasarin@gmail.com](mailto:lupasarin@gmail.com) wrote:

> Hello! This is a question I posted on StackOverflow (  
> [elasticsearch - Replace values with predefined mapping with ELK - Stack Overflow](http://stackoverflow.com/questions/28644501/replace-values-with-predefined-mapping-with-elk))  
> for which I didn't get any answer yet:
> 
> I have a file that I read with Logstash containing a certain parameter  
> called type. The possible values for this parameter are 0,1,2,3,4,5 (it  
> is actually represented as an Enum in my Java code).
> 
> Let's say type 0 means book, type 1 means newspaper, type 2 means  
> magazine, etc.
> 
> Currently my Logstash filter writes this parameter directly as the number,  
> but I would like to display panels on Kibana Dashboards that would show me  
> the value (e.g. book) instead of the number (i.e. 0).
> 
> Is there any possibility to add replacements or mappings to a list of  
> predefined values at Kibana level? Or should I do this mapping manually at  
> Logstash level with ifconditions? What would be the best approach?
> 
> Thanks for your help in advance!
> 
> --  
> You received this message because you are subscribed to the Google Groups  
> "elasticsearch" group.  
> To unsubscribe from this group and stop receiving emails from it, send an  
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
> To view this discussion on the web visit  
> [https://groups.google.com/d/msgid/elasticsearch/8d4ed42d-93a3-45b7-b28e-377c9ddff2f1%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8d4ed42d-93a3-45b7-b28e-377c9ddff2f1%40googlegroups.com)  
> [https://groups.google.com/d/msgid/elasticsearch/8d4ed42d-93a3-45b7-b28e-377c9ddff2f1%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/8d4ed42d-93a3-45b7-b28e-377c9ddff2f1%40googlegroups.com?utm_medium=email&utm_source=footer)  
> .  
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X9g-k9gA7nuH5GFGhWfyJG8JRSCh%2BG5UG\_siCyPzeTukA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X9g-k9gA7nuH5GFGhWfyJG8JRSCh%2BG5UG_siCyPzeTukA%40mail.gmail.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:30am UTC](https://discuss.elastic.co/t/replace-values-with-predefined-mapping-with-elk/22316/3 "2017-07-06T00:30:56Z")

</div>


