Translate filter is not working when the input is from filebeat module

Elastic Stack Logstash
1

Hi all,

We have two different logstash pipelines for two different location data.

  1. Paloalto --> syslog --> filebeat --> Logstash --> Elasticsearch (Parsing with filebeat panw module)
  2. Paloalto --> syslog --> Logstash --> Elasticsearch(parsing with grok)

All the data is parsing correctly in both the cases. Now we have a new requirement where we need to compare a field source.ip with a dictionary using translate filter. This is working perfectly in case 2 but not working in case 1.
Please find the below translate filter im using in both the cases.

        translate {
        field => "destination.ip"
        destination => "event.MM_ids_ip"
        dictionary_path => '/tmp/IPv4_feedHCMCWithValue.csv'
        refresh_interval => 300
        override => "true"
        refresh_behaviour => "replace"
      }

So I believe this translate filter is failing in case of filebeat module usage. Can u help us solve this issue.

2

Are you sure the field name has a period in it? Or is it the ECS [destination][ip]?

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.