Translate Filters :: Can the Dictionary File Include a Range?

Elastic Stack Logstash
1

Hi Logstash Maestros,

In my Logstash config file, I have a simple translate filter:

filter {

  translate {
    field => "[MyData][FieldA]"
    destination => "[MyData][FieldB]"
    dictionary_path => "/usr/share/logstash/config/MyDictionary.yaml"
    fallback => "UNKNOWN"
  }
}

And MyDictionary.yaml is pretty simple:

"1": Apples
"2": Bananas
"3": Cantaloupes

All of this works great. The trouble is, I’ve just learned now any FieldA value between 10,000 and 100,000 should be translated into “Vegetables.” I could do something like this:

filter {

  if [MyData][FieldA] >= 10000 and [MyData][FieldA] <= 100000 {
    mutate {
      add_field => { "[MyData][FieldB]" => 'Vegetables' }
    }
  }

  else {
    translate {
      field => "[MyData][FieldA]"
      destination => "[MyData][FieldB]"
      dictionary_path => "/usr/share/logstash/config/MyDictionary.yaml"
      fallback => "UNKNOWN"
    }
  }
}

But at my company, this requires a scheduled production change and an internal code review and is a big pain from a management standpoint. I could also expressly list every value between 10,000 and 100,000 within MyDictionary.yaml, but obviously that’s none too elegant either.

I’d love a solution where I can just change MyDictionary.yaml and Logstash would understand the range, something like:

"1": Apples
"2": Bananas
"3": Cantaloupes
"10000" - "100000": Vegetables

I get that this is unlikely to be the case, but I thought I’d pose the question. If you see a better solution, please suggest. Thank you!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.