Translate filter is not working

Elastic Stack Logstash
1

Logstash Version - 6.6.2
Translate Filter Version - 3.0.4
Drop Filter Version - 3.0.5

logstash-config
=============

input {
stdin { codec => json }
}
filter {
translate {
field => "comp"
dictionary_path => "/etc/logstash/conf.d/comp_enable.yml"
}
# if [component] == "rabbitmq" {
# if "[component]" == "%{comp}" {
if [component] == "%{comp}" {
drop { }
}
}
output {
stdout { codec => rubydebug }
}
======

When hard-coding the value of comp (commented line) it works as expected - the logs are dropped, I don't get anything on console as output.

But when passing with the variable it's not working as expected.

The file /etc/logstash/conf.d/comp_enable.yml has below contents:

"kafka": "disable"
"rabbit": "disable"

And I am passing the below string as input logline:

{ "component":"rabbitmq" }

Anything wrong here? Can anyone from the experts group please suggest how can I achieve this?

-Bijay

2

The field you want to look up is named component so that's what you should put in your translate filter's comp option. The translate filter will then look up the contents of the component field in the table, and in your example it'll get a match and store "disable" in the translation field (if you want to store it another field you'll have to adjust the destination option). So, what you're looking for is probably this:

if [translation] == "disable" {
  drop { }
}
3

Thanks a lot Magnus, it worked. I have one more issue related to input config file. If the input config file is a symlink logstash is unable to read it. Is it expected behaviour?

4

I would expect it to work, but googling the topic indicates that it doesn't actually work.

5

Thanks for the update Magnus..