# RuntimeError: LogStash::Filters::Translate: can't convert Array into Hash when loading dictionary

**URL:** <https://discuss.elastic.co/t/runtimeerror-logstash-filters-translate-cant-convert-array-into-hash-when-loading-dictionary/67632>\
**Category:** Logstash\
**Created:** [November 30, 2016, 2:34pm UTC](https://discuss.elastic.co/t/runtimeerror-logstash-filters-translate-cant-convert-array-into-hash-when-loading-dictionary/67632 "2016-11-30T14:34:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![imperfection\_perfect](https://avatars.discourse-cdn.com/v4/letter/i/e9bcb4/32.png) [@imperfection\_perfect](https://discuss.elastic.co/u/imperfection_perfect)\
**Post date:** [November 30, 2016, 2:34pm UTC](https://discuss.elastic.co/t/runtimeerror-logstash-filters-translate-cant-convert-array-into-hash-when-loading-dictionary/67632/1 "2016-11-30T14:34:39Z")

</div>

Hi Team,

I have the following usescase,

I am on logstash 2.x

installed the logstash translate filter logstash-filter-translate-2.1.4

[3letterISOCountryCodeToLatLongMapping](https://github.com/logstash-plugins/logstash-filter-geoip/files/609660/Json3LetterCountryCode.zip)

but this is not working and i get a run time error and says Pipeline Aborted.

can you please help with this.

```
> filter
> {
> if [type] == "eventstats" {
> grok {
> remove_field => message
> match => { message => "(?m)%{TIMESTAMP_ISO8601:sourceTimestamp} \[%{NUMBER:threadid}\] %{LOGLEVEL:loglevel} - %{WORD:envName}\|%{IPORHOST:actualHostMachine}\|%{WORD:applicationName}\|%{NUMBER:empId}\|%{WORD:regionCode}\|%{DATA:country}\|%{DATA:eventName}\|%{NUMBER:staffeventId}\|%{WORD:eventEvent}" }

> }

> if !("_grokparsefailure" in [tags]) {
> translate {
> field => "%{country}"
> destination => "mapdata"
> dictionary_path => '/opt/logstash/GeoIPDataFile/Json3LetterCountryCode.json'
> }

> mutate {
> add_field => ["[geoip][coordinates]", "%{[mapdata][longitude]}" ]
> add_field => ["[geoip][coordinates]", "%{[mapdata][latitude]}" ]
> remove_field => ["mapdata"]
> add_tag => "eventstats"
> add_tag => ["eventFor_%{eventName}"]
> 	
> }
> }
> }
>    
> }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 5, 2016, 6:34am UTC](https://discuss.elastic.co/t/runtimeerror-logstash-filters-translate-cant-convert-array-into-hash-when-loading-dictionary/67632/2 "2016-12-05T06:34:03Z")

</div>

> ```
> field => "%{country}"
> 
> ```

So the name of the country is stored in the `country` field? Change to:

```
field => "country"

```

With your current configuration you're saying "translate the field whose name is found in the `country` field" rather than "translate the `country` field".

> but this is not working and i get a run time error and says Pipeline Aborted.

Without the exact error message it's usually very hard to help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2017, 6:34am UTC](https://discuss.elastic.co/t/runtimeerror-logstash-filters-translate-cant-convert-array-into-hash-when-loading-dictionary/67632/3 "2017-01-02T06:34:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.