Translate doesnt work when key in yml dictionary is a number

Elastic Stack Logstash
1

Hi, I have this yml dictionary

1967345056 : "VISACI nodata IIS"

and this is the translate:

    translate {
        field => "[monitorgroup]"
        destination => "[nuevo_campo]"
        dictionary_path => "/etc/logstash/conf.d/list-clients.yml"
        fallback => "no match"
    }

-The path is right, the field exists, is a string
-I have tried to convert the field "monitorgroup" to integer, doesnt work either
-I have checked that the spaces in the dictionary are not tabs in VScode
-Usually when you open a YML in Vim editor, it colours the dictionary, but with this file that doesnt happens, I dont know if this is relevant
-Im running logstash with the command:
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/filebeat/my.conf
dont know if this is relevant either

2

The translate filter coerces the key to be a string before doing the lookup.

I wonder if this is because either libyaml or Psych (the ruby wrapper for it) convert numeric keys to strings.

Can you change your dictionary to this?...

"1967345056" : "VISACI nodata IIS"
3

Hi, badger, tried just now, doesnt work either, as a string or as an integer, when adding the quotes

the logstash version is 7.2, I have other pipelines with translate, one with IP addreses as keys, and another with strings as key, but this is only one that doesnt work....same file permission.

4

Hey @Badger , I think you where into something....I preppend an "a" to the value of the field in the pipeline and in the yml, and now it works.

    mutate {
              add_field => { "testmon" => "a%{monitorgroup}" }
   }

YML

a1967345056 : "VISACI nodata IIS"

can you think of what whas happening? i dont get it.

5

When I tested that it worked OK. You did have [monitorgroup] as a string too, right?

6

yes, I tried as a string and as a integer :man_shrugging:

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.