filter {
    translate {
        field => "[netflow][protocol]"
        destination => "[netflow][protocol]"
        override => "true"
        dictionary => [ "6", "TCP",
                        "17", "UDP",
                        "1", "ICMP",
                        "47", "GRE",
                        "50", "ESP" ]
    }
    mutate {
        add_field => { "[netflow][application]" => "%{[netflow][protocol]}" }
    }
    translate {
        field => "[netflow][application]"
        destination => "[netflow][application]"
        override => "true"
        dictionary_path => "/etc/logstash/conf.d/tcp_service_mappings.conf"
    }
}