Module: LogStash

Defined in:

lib/logstash/filters/translate.rb,
lib/logstash/filters/dictionary/file.rb,
lib/logstash/filters/dictionary/memory.rb,
lib/logstash/filters/dictionary/csv_file.rb,
lib/logstash/filters/fetch_strategy/file.rb,
lib/logstash/filters/single_value_update.rb,
lib/logstash/filters/dictionary/json_file.rb,
lib/logstash/filters/dictionary/yaml_file.rb,
lib/logstash/filters/fetch_strategy/memory.rb,
lib/logstash/filters/array_of_values_update.rb,
lib/logstash/filters/array_of_maps_value_update.rb,
lib/logstash/filters/dictionary/streaming_yaml_parser.rb,
lib/logstash/filters/dictionary/yaml_visitor.rb

Overview

A general search and replace tool that uses a configured hash and/or a file to determine replacement values. Currently supported are YAML, JSON, and CSV files.

The dictionary entries can be specified in one of two ways: First, the dictionary configuration item may contain a hash representing the mapping. Second, an external file (readable by logstash) may be specified in the dictionary_path configuration item. These two methods may not be used in conjunction; it will produce an error.

Operationally, if the event field specified in the field configuration matches the EXACT contents of a dictionary entry key (or matches a regex if regex configuration item has been enabled), the field's value will be substituted with the matched key's value from the dictionary.

By default, the translate filter will replace the contents of the maching event field (in-place). However, by using the destination configuration item, you may also specify a target event field to populate with the new translated value.

Alternatively, for simple string search and replacements for just a few values you might consider using the gsub function of the mutate filter.

Defined Under Namespace

Modules: Filters