# Using Regex in Yaml for Logstash Translate Filter

**URL:** <https://discuss.elastic.co/t/using-regex-in-yaml-for-logstash-translate-filter/70855>\
**Category:** Logstash\
**Created:** [January 7, 2017, 1:48pm UTC](https://discuss.elastic.co/t/using-regex-in-yaml-for-logstash-translate-filter/70855 "2017-01-07T13:48:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kyle\_Belitz](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kyle\_Belitz](https://discuss.elastic.co/u/Kyle_Belitz)\
**Post date:** [January 7, 2017, 1:48pm UTC](https://discuss.elastic.co/t/using-regex-in-yaml-for-logstash-translate-filter/70855/1 "2017-01-07T13:48:31Z")

</div>

Good day all, I need some help.

I am trying to use the Logstash Translate Filter to enrich network data that bro is generating and that I'm ingesting into my ELK stack. For example, here is how i was enriching data manually:

```
translate {
    field => "id.orig_h"
    destination => "src_comp_name"
    dictionary => [
        "192.168.1.1", "Home_Router",
        "192.168.1.150", "My_Laptop",
        "192.168.1.210", "My_Desktop"
        ]
}

```

While this works, it doesn't scale for what I am going to eventually need it for. So I'm trying to move my dictionary to a yaml file and use regex to match IP addresses to assign them tags. so I edited my translate function to:

```
translate {
    field => "id.orig_h"
    destination => "src_comp_name"
    dictionary_path => '/etc/logstash/config/compNames.yaml'
}

```

Below is the contents of roughly what I _want_ to do in the Yaml file:

```
'^192\.168\.1\.[1-2]$': "Home_Routers"
'^192\.168\.1\.1[0-9]{2}$': "Home_Laptops"
'^192\.168\.1\.2[0-9]{2}$': "Home_Desktops"

```

This would cause 192.168.1.1/2 to be tagged as routers, anything in the .100-199 range to be tagged as Home\_Laptops, and anything from 200-255 to be tagged as "Home\_Desktops". I have tried multiple ways of using regex in the Yaml file, but I'm either getting errors like "LogStash::Filters::Translate: can't convert Array into Hash when loading dictionary file at /etc/logstash/config/compNames.yaml", or logstash is correctly starting but not tagging traffic that _should_ be matching.

Any guidance out there on how to implement regex matching in a Yaml file for data enrichment via Logstash Translate Filter?

---

<div class="post-metadata">

**Author:** ![Kyle\_Belitz](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kyle\_Belitz](https://discuss.elastic.co/u/Kyle_Belitz)\
**Post date:** [January 7, 2017, 2:30pm UTC](https://discuss.elastic.co/t/using-regex-in-yaml-for-logstash-translate-filter/70855/2 "2017-01-07T14:30:19Z")

</div>

For posterity's sake, I just got the answer to my question here: [http://stackoverflow.com/questions/41522280/how-to-use-regex-in-yaml-file-for-logstash-translate-filter](http://stackoverflow.com/questions/41522280/how-to-use-regex-in-yaml-file-for-logstash-translate-filter)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 8, 2017, 1:46am UTC](https://discuss.elastic.co/t/using-regex-in-yaml-for-logstash-translate-filter/70855/3 "2017-01-08T01:46:51Z")

</div>

Yep, also see [https://www.elastic.co/guide/en/logstash/5.1/plugins-filters-translate.html#plugins-filters-translate-regex](https://www.elastic.co/guide/en/logstash/5.1/plugins-filters-translate.html#plugins-filters-translate-regex)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2017, 1:46am UTC](https://discuss.elastic.co/t/using-regex-in-yaml-for-logstash-translate-filter/70855/4 "2017-02-05T01:46:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.