Inplace translate not working

[rrbarbosa]

The following translate filter does not seem to work. In the logstash output I still see dport entries with the value -. However, if I uncomment the destination option, the filter works as expected, generating a test field with value -1 when appropriate. Why is the inplace translation not working?

translate {
field => "dport"
#destination => "test"
dictionary => ["-", "-1"]
}

Some background: I am trying to have all dport values as integers, so the field can be indexed correctly by elasticsearch. The field dport should contain an integer, however if the field was not initialized the value - is logged.

I posted this as a question on stackoverflow, but I realized now this might be a bug.

[purbon]

Hi,
sorry It took such a long time for us to come back here, too much work. Today I test this behaviour with the last version of the plugins by adding this test:

 describe "implace translation" do

    let(:config) do
      {
        "field"       => "status",
        "dictionary"  => [ "-", "-1"]
      }
    end

    let(:event) { LogStash::Event.new("status" => "-") }

    it "return the exact translation" do
      subject.register
      subject.filter(event)
      expect(event["translation"]).to eq("-1")
    end
  end

and everything works as expected. Keep in mind the default field for a translation is the translation field, not sure if this might be the source of your issue.

closing this issue for now, feel free to reopen this if necessary.