I am new to logstash, and was trying to process some XML records that I have in a database, a record in each cell.
(the goal is indexing them in elasticsearch.)
The xml filter plugin was an obvious choice, with the xpath option. And from the documentation and many examples out there, I understood that, given my setup, every record will in turn populate the "message" field.
The problem was that none of my destination fields defined in the xpath hashes were ever making it to the output.
Then I found that my XML documents actually populate a source field called "xml", which is not documented anyway. source => "xml" seems to work.
Is there a lack in the documentation, or something I simply overlooked?