96_lookup_iana_protocol.conf

# Copyright [2021] [Cargill, Incorporated.] 
# SPDX-License-Identifier: Apache-2.0
filter {
  if "disable_lookup_iana_protocol_enrichment" in [tags] or "disable_lookups" in [tags] or "disable_enrichments" in [tags] {
    mutate {
      remove_tag => ["disable_lookup_iana_protocol_enrichment"]
    }
  } else {
    if ![network.protocol] and [destination.port] { 
      translate {
        field => "[destination.port]"
        dictionary_path => "${LOGSTASH_HOME}/config/iana_protocols.csv"
        destination => "[network.protocol]"
        override => "true"
        # Disable refresh from disk because when we update the dictionary file, we restart logstash explicitly
        refresh_interval => 0
      }
    }
    if ![network.protocol] and [server.port] { 
      translate {
        field => "[server.port]"
        dictionary_path => "${LOGSTASH_HOME}/config/iana_protocols.csv"
        destination => "[network.protocol]"
        override => "true"
        # Disable refresh from disk as when we update the dictionary file, we restart logstash explicitly
        refresh_interval => 0
      }
    }
    if ![network.protocol] and [url.port] { 
      translate {
        field => "[url.port]"
        dictionary_path => "${LOGSTASH_HOME}/config/iana_protocols.csv"
        destination => "[network.protocol]"
        override => "true"
        # Disable refresh from disk as when we update the dictionary file, we restart logstash explicitly
        refresh_interval => 0
      }
    }
  }
}