module LogStash

A general search and replace tool that uses a configured hash and/or a file to determine replacement values. Currently supported are YAML, JSON, and CSV files.

The dictionary entries can be specified in one of two ways: First, the `dictionary` configuration item may contain a hash representing the mapping. Second, an external file (readable by logstash) may be specified in the `dictionary_path` configuration item. These two methods may not be used in conjunction; it will produce an error.

Operationally, if the event field specified in the `field` configuration matches the EXACT contents of a dictionary entry key (or matches a regex if `regex` configuration item has been enabled), the field's value will be substituted with the matched key's value from the dictionary.

By default, the translate filter will replace the contents of the maching event field (in-place). However, by using the `destination` configuration item, you may also specify a target event field to populate with the new translated value.

Alternatively, for simple string search and replacements for just a few values you might consider using the gsub function of the mutate filter.