# Translate filter not working

**URL:** https://discuss.elastic.co/t/translate-filter-not-working/87505
**Category:** Logstash
**Created:** [May 30, 2017, 6:14am UTC](https://discuss.elastic.co/t/translate-filter-not-working/87505 "2017-05-30T06:14:27Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)
#### Post date: [May 30, 2017, 6:14am UTC](https://discuss.elastic.co/t/translate-filter-not-working/87505/1 "2017-05-30T06:14:28Z")

</div>

Hi,

I'm using the translation filter to look up some values. This works but the issue I'm running into is that I want to keep the original field untouched so I need to copy the field and replace the value in the new field with the dictionary file value if an entry exists or otherwise keep the original value.

I'm trying to use an IF statement to check if the field exists and surely this works, if the field exists a new field with the same value is created. But for some reason when using the IF statement the translate filter doesn't working anymore.

```auto
input {
   udp {
     port => 9995
	type => "netflow"
	codec => netflow {
	versions => [9]
}
}
}

filter {
  mutate {
    add_field => {
      "[netflow][ipv4_dst_host]" => "%{[netflow][ipv4_dst_addr]}"
      "[netflow][ipv4_src_host]" => "%{[netflow][ipv4_src_addr]}"
    }
  }

  if ([netflow][l4_dst_port]) {
   mutate {
     add_field => {
      "[netflow][l4_dst_port_translation]" => "%{[netflow][l4_dst_port]}"
     }
   } 
  }

  translate {
    dictionary_path => '/etc/logstash/port_translation.yaml'
    field => "[netflow][l4_dst_port]"
    destination => "[netflow][l4_dst_port_translation]"
  }

  dns {
    action => 'replace'
    reverse => "[netflow][ipv4_dst_host]"
  }

  dns {
  action => 'replace'
  reverse => "[netflow][ipv4_src_host]"
  }
}

output {
if [type] == "netflow" {
elasticsearch {
hosts => localhost
index => "netflow-%{+YYYY.MM.dd}"
}
}
}
```

---

<div class="post-metadata">

### Author: ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)
#### Post date: [May 30, 2017, 6:35am UTC](https://discuss.elastic.co/t/translate-filter-not-working/87505/2 "2017-05-30T06:35:41Z")

</div>

Okay think I figured it out.

Had to use override =\> true

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 27, 2017, 6:36am UTC](https://discuss.elastic.co/t/translate-filter-not-working/87505/3 "2017-06-27T06:36:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.