Translate CSV with varios fields

Elastic Stack Logstash
1

Hi,
I am using translate filter to to compara fields from a CSV. CSV have two fields, but now I need a 3 fields.

Actual CSV

148.244.114.49,malicious_IP

New CSV

148.244.114.49,malicious, botnet
148.244.113.9,malicious, spam

My filter from logstahs:

      translate {
      field => "[id.resp_h]"
      destination => "malicious_IP"    
      dictionary_path => "/home/events.csv" 
      override => true

Description: if value of id.resp_h is on de dictionay events.csv, add new field "malicious_IP"

Now I need to add one more fields. I need and the value of "botnet", "spam", ...

How can I do that?
thanks.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.