Translate CSV with varios fields

I am using translate filter to to compara fields from a CSV. CSV have two fields, but now I need a 3 fields.

Actual CSV,malicious_IP

New CSV,malicious, botnet,malicious, spam

My filter from logstahs:

      translate {
      field => "[id.resp_h]"
      destination => "malicious_IP"    
      dictionary_path => "/home/events.csv" 
      override => true

Description: if value of id.resp_h is on de dictionay events.csv, add new field "malicious_IP"

Now I need to add one more fields. I need and the value of "botnet", "spam", ...

How can I do that?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.