Tranlate filter for bind logs but multiple fields


I am collecting bind9 logs through logstash; now I am thinking of using translation plugin but the my destination field varies and I want that to be appear in logs or should get indexed. Can someone please give me any clue or if any idea with logstash plugin to achieve this?

Here is I want to achieve and my dictionary file

translate {
field => "query"
destination => "????????"
refresh_interval => 200
dictionary_path => '/etc/logstash/doms.yaml'

"": "Glupteba"
"": "emotet"
"": "emotet"
"": "Phishing"
"": "RAT"
"": "Glupteba"
"": "Ramcos"
"": "APT28"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.