Variable in path

[Sam_Kisada]

Hi!
I need some help with declaring variable in dicrianary_path
I have few filebeats which sending data to logstash from few different sources. Data is separeted to dictianary and raw, there is no chance to change it becouse of data current size

I have parsed dictianary by script and get files named per source like this
${base_id}_dictionary.yml

sample:
85866397-9ed7-4b10-ae86-31f6878f7fd2_dictionary.yml
a48ad896-1b19-47d7-bd6f-8396ff92d181_dictionary.yml
........

Id, which contains in it, may be the same per source, but data may not

sample:

file1

8 : "96000-ws095"
9 : "96000-WS634"
10 : "90500-ws002"

file2

8 : "9990-wt095"
9 : "965000-t34"
10 : "90500-q12"

I get base id using grok, but i cant use it in dicrtianory_path

translate {
        field => "[base_id]"
        destination => "[base_name]"
        dictionary_path => "C:\elk\yml\%{base_id}_list.yml"
        refresh_interval => 104
        fallback => "Nothing to match!"

error:

 filter {
    translate {
      # This setting must be a path
      # File does not exist or cannot be opened C:\elk\yml\%{base_id}_list.yml
      dictionary_path => "C:\\elk\\yml\\%{base_id}_list.yml"
      ...

and another error
Cannot evaluate ${base_id}

Can i declare ${base_id}= (some field) in if ? Or there is another solution?

[Badger]

@Sam_Kisada

I get base id using grok, but i cant use it in dicrtianory_path

Correct. The translate filter does not do sprintf processing before opening the file.

[Sam_Kisada]

Thanks for reply mr Badger=)
any tips or ideas?
Mayby this?

Current workaround is big dictionary with modifed id :
'$host_$source_$id' : 'data'

[Christian_Dahlqvist]

It loads the file at startup so can not use data from events. Your workaround is what I would recommend.