# Best practice - field mapping

**URL:** <https://community.graylog.org/t/best-practice-field-mapping/1194>\
**Category:** Graylog Central (peer support)\
**Created:** [May 19, 2017, 1:33pm UTC](https://community.graylog.org/t/best-practice-field-mapping/1194 "2017-05-19T13:33:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![profhase](https://avatars.discourse-cdn.com/v4/letter/p/22d042/32.png) [@profhase](https://community.graylog.org/u/profhase)\
**Post date:** [May 19, 2017, 1:33pm UTC](https://community.graylog.org/t/best-practice-field-mapping/1194/1 "2017-05-19T13:33:08Z")

</div>

I have a csv file that has descriptions for a field in message. Example messages are

```
{id_field: cryptic_id1}
{id_field: cryptic_id2}

```

and the csv file that acts as dictionary:

```
 cryptic_id1,Readable Description1
 cryptic_id2,Readable Description2

```

I would like to be able to add the description fields into the message dynamically, so if the cryptic\_id is contained in the csv file a translation field would be added to the message.

My first idea was to generate a rule with a script to create a long rule in pipeline with a lot of when conditions and then paste the output in interface.  
Unfortunately a rule can only have one ‘when’ conditions and creating a lot of rules would require a lot of clicking.

How would I do it otherwise?

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [May 19, 2017, 1:46pm UTC](https://community.graylog.org/t/best-practice-field-mapping/1194/2 "2017-05-19T13:46:42Z")

</div>

You will be able to use the new lookup tables feature in Graylog 2.3.0 for this:

> **[Announcing Graylog v2.3.0-alpha.2 | The Graylog Blog](https://www.graylog.org/post/announcing-graylog-v2-3-0-alpha-2)**
>
> This is the first public alpha release on our journey to Graylog v2.3! For Graylog v2.3, we are focusing on two main features: support for Elasticsearch 5 and Lookup Tables.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 2, 2017, 1:46pm UTC](https://community.graylog.org/t/best-practice-field-mapping/1194/3 "2017-06-02T13:46:48Z")

</div>

Closed on June 2, 2017, 1:46pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.