Translate plugin doesn't work

Elastic Stack Logstash
1

Dear community,

I tried to add descriptions of network protocols but unfortunately it doesn't work :frowning:

Here is the part of logstash's config file

   #Protocol friendly naming
   translate {
      field => "[netflow][protocol]"
      dictionary => [ 6, "TCP", 17, "UDP", 1, "ICMP", 47, "GRE", 50, "ESP" ]
   }

But the new field with translation didn't appear and I don't understand why.

2

With the current version the translate plugin only accept single field references, not field references. I think this that this is what is wrong for your config. I agree it would be very nice to have , could you open an issue at https://github.com/logstash-plugins/logstash-filter-translate

  • purbon
3

Hi Purbon,
Thank you for your answer.
I solved the issue. I re-read the documentation and paid attention on this "Make sure you specify any integer-based keys in quotes"
And after taking integer keys in quotes all works perfectly :slight_smile:

4

Can you post the config you have, it may be useful for others in future as well :slight_smile:

5

I'd love to see your working config, I've run in to the same problem. I'm using this filter:

filter {
  translate {
    field => "[netflow][protocol]"
    dictionary => [
		   "2", "IGMP",
		   "17", "UDP",
	    	   "50", "ESP",
		   "89", "OSPF"
		 ]
  }
}

but no luck. Data in ES still shows the integer value for netflow.protocol, instead of the translated value.

6

Oops, never mind. I too read the documentation more closely. By default, the translated value shows up in a new field called "translation". You need to specify a destination field (destination => "[netflow][some_field]") to use a different field. If you specify the same field as the source field, it will replace the value. I also added "override => true", though I am not certain it's required for this.

1 Like