Translate filter error with dictionary file

Elastic Stack Logstash
1

Logstash is giving me an error with the translate filter, it says that the dictionary file format is not correct:

Pipeline aborted due to error {:exception=>#<RuntimeError: LogStash::Filters::Translate: LogStash::Filters::Translate: Dictionary /opt/logstash/tables/maliciousips have a non valid format when loading dictionary file at /opt/logstash/tables/maliciousips>, :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-translate-2.1.3/lib/logstash/filters/translate.rb:234:in loading_exception'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-translate-2.1.3/lib/logstash/filters/translate.rb:196:inload_dictionary'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-translate-2.1.3/lib/logstash/filters/translate.rb:127:in register'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/pipeline.rb:182:instart_workers'", "org/jruby/RubyArray.java:1613:in each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/pipeline.rb:182:instart_workers'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/pipeline.rb:136:in run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/agent.rb:465:instart_pipeline'"], :level=>:error}
stopping pipeline {:id=>"main"}

Here is the output of the test dictionary file:

cat /opt/logstash/tables/maliciousips
100.0.240.30: Binary Defense IP

Isn't that the correct file format?

2

It seems to be ok and your call to translate ?

3

on my case im using the 2.0.2 version of translate filter and works fine

i had the same problem with the latest version of translate filter (2.1.3)

cordially

4

I found the problem, i just added the .yaml extension to the filename, I had it without it on a previous logstash version.
Thanks for the reply.

1 Like
5

Just ran into the same problem, used to have my dictionary files end with .dict because why not and nothing seemed to work setting up a slightly more recent version of the filter. Changing all files to .yaml solved this problem.

6

This will help in future - https://github.com/logstash-plugins/logstash-filter-translate/pull/28