如何覆盖Kibana中的字段值？

Question

I am using Logstash to feed data into Elasticsearch and then analyzing that data with Kibana. I have a field that contains numeric identifiers. These are not easy to read. How can I have Kibana overwrite or show a more human-readable value?

More specifically, I have a 'ip.proto' field. When this field contains a 6, it should be shown as 'TCP'. When this field contains a 7, it should be shown as 'UDP'.

I am not sure which tool in the ELK stack I need to modify to make this happen.

Thanks

Answer 1

You can use conditionals and the mutate filter :

filter {
  if [ip][proto] == "6" {
    mutate {
      replace => ["[ip][proto]", "TCP"]
    }
  } else if [ip][proto] == "7" {
    mutate {
      replace => ["[ip][proto]", "UDP"]
    }
  }
}

This quickly gets clumsy, and the translate filter is more elegant (and probably faster). Untested example:

filter {
  translate {
    field => "[ip][proto]"
    dictionary => {
      "6" => "TCP"
      "7" => "UDP"
    }
  }
}