# Translate Config works from STDIN but not Beats input

**URL:** <https://discuss.elastic.co/t/translate-config-works-from-stdin-but-not-beats-input/81653>\
**Category:** Logstash\
**Created:** [April 7, 2017, 6:15pm UTC](https://discuss.elastic.co/t/translate-config-works-from-stdin-but-not-beats-input/81653 "2017-04-07T18:15:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dshepard](https://avatars.discourse-cdn.com/v4/letter/d/fbc32d/32.png) [@dshepard](https://discuss.elastic.co/u/dshepard)\
**Post date:** [April 7, 2017, 6:15pm UTC](https://discuss.elastic.co/t/translate-config-works-from-stdin-but-not-beats-input/81653/1 "2017-04-07T18:15:30Z")

</div>

The following code works if I paste the data into STDIN, but when the data comes from BEATS it fails to create the geoip fields. I just get a translation field with the result in it.

#This is from the logstash config

```
	#Private IP Geo Lookup
	if "_geoip_lookup_failure" in [tags] {
		translate {
			regex => true
			dictionary_path => "./config/priv_ip_trans.yml"
			field => "CallingStation_IP"
			remove_tag =>"_geoip_lookup_failure"
		}
	}

```

#This is a sample line from the priv\_ip\_trans.yml  
'10.90.3.\*': '{"geoip":{"Latitude": 37.7576948, "Longitude": -122.4726193, "Location": [-122.4726193, 37.7576948],"country\_name": "United States", "country\_code2": "US", "country\_code3": "US", "continent\_code":" NA", "city\_name": "San Francisco", "region\_code": "CA", "region\_name": "California", "postal\_code": "94114", "timezone": "America/Los\_Angeles"}}'

#This is what gets output when using beats:

```
              "translation" => "{\"geoip\":{\"Latitude\": 37.7576948, \"Longitude\": -122.4726193, \"Location\": [-122.4726193, 37.7576948],\"country_name\": \"United States\", \"country_code2\": \"US\", \"country_code3\": \"US\", \"continent_code\":\" NA\", \"city_name\": \"San Francisco\", \"region_code\": \"CA\", \"region_name\": \"California\", \"postal_code\": \"94114\", \"timezone\": \"America/Los_Angeles\"}}",

```

This is what I get when using STDIN:

```
      "geoip" => {
         "city_name" => "San Francisco",
          "timezone" => "America/Los_Angeles",
      "country_name" => "United States",
     "country_code2" => "US",
     "country_code3" => "US",
    "continent_code" => " CA",
          "Latitude" => 36.0768949,
       "region_name" => "California",
       "postal_code" => "94114",
         "Longitude" => -122.4726193,
          "Location" => [
        [0] 36.0768949,
        [1] -122.4726193
    ],
       "region_code" => "CA"
},
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 12, 2017, 5:21am UTC](https://discuss.elastic.co/t/translate-config-works-from-stdin-but-not-beats-input/81653/2 "2017-04-12T05:21:32Z")

</div>

To me it sounds very unlikely that the translate filter would behave differently depending on the input. You can always use a json filter to deserialize the JSON string.

Your stdin example doesn't match your sample line from priv\_ip\_trans.yml. Had you shown the entire event from your stdout output it would've been easier to see if that was expected.

---

<div class="post-metadata">

**Author:** ![dshepard](https://avatars.discourse-cdn.com/v4/letter/d/fbc32d/32.png) [@dshepard](https://discuss.elastic.co/u/dshepard)\
**Post date:** [April 13, 2017, 2:11pm UTC](https://discuss.elastic.co/t/translate-config-works-from-stdin-but-not-beats-input/81653/3 "2017-04-13T14:11:24Z")

</div>

You were right, I was missing the JSON Filter. Don't know how I missed that. Thanks for the kick in the head to straighten my thoughts out.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2017, 2:20pm UTC](https://discuss.elastic.co/t/translate-config-works-from-stdin-but-not-beats-input/81653/4 "2017-05-11T14:20:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.