Translate filter

how to match multiple fields using translate filter?

Please provide more information on what you are trying to achieve.
What do you mean by [quote="Kishore, post:1, topic:56359"]
multiple fields

I want to generate an alert if there is any change in User Country from the below mentioned scenario.

Log looks like below:
Jul 25 07:18:24 ip-10-129-23-37 openvpn[69098]: kishore/ MULTI_sva: pool returned IPv4=, IPv6=(Not enabled)

I was able to capture Username: kishore and Country Name: India/USA from the above log to store in the Dictonary file to match, i am trying to match both fields in the log if log occurs second time.

If i could be able to match and find there is any change in Country , i want to generate an alert.

You are better off using Alerting (Watcher) or similar.

Else can you please suggest me that how to merge two fields

filter {
mutate {
add_field => {
"new_field" => "%{field1} %{field2}"

Hope this helps!

Thanks Buster.