# Translate with array fields
**URL:** https://discuss.elastic.co/t/translate-with-array-fields/228196
**Category:** Logstash
**Created:** [April 15, 2020, 7:22pm UTC](https://discuss.elastic.co/t/translate-with-array-fields/228196 "2020-04-15T19:22:20Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@mtudisco](https://discuss.elastic.co/u/mtudisco)
#### Post date: [April 15, 2020, 7:22pm UTC](https://discuss.elastic.co/t/translate-with-array-fields/228196/1 "2020-04-15T19:22:20Z")
Hi,
Im using winlogbeat to send information to logstash and then all the information goes to a log in filesystem and some information goes to elasticsearch.
To identify which information to store in ES, I identify certain events i dont want to store, those events are based on some values for [winlog][provider\_name] [winlog][task] and [winlog][keywords].
I'd like to use translate, but as the field [winlog][keywords] is an array i dont know if theres something like an IN
for instance:
```
{
"winlog": {
"keywords": [
"Audit Success"
],
"provider_name": "Microsoft-Windows-Security-Auditing",
"task": "Logon",
}
```
I want to be able to tell that if provider\_name is "Microsoft-Windows-Security-Auditing" and task is "Logon" and "Audit Success" is in Keywords, then i want to add a field to\_es with "false"
I can do it with if-then-else, but would like to use translate as its more easy to customize and maintain in the future.
Any idea?
thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 13, 2020, 7:22pm UTC](https://discuss.elastic.co/t/translate-with-array-fields/228196/2 "2020-05-13T19:22:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.