A lack in the logstash documentation?

Elastic Stack Logstash
1

Hello!
I am new to logstash, and was trying to process some XML records that I have in a database, a record in each cell.
(the goal is indexing them in elasticsearch.)

The xml filter plugin was an obvious choice, with the xpath option. And from the documentation and many examples out there, I understood that, given my setup, every record will in turn populate the "message" field.

The problem was that none of my destination fields defined in the xpath hashes were ever making it to the output.

Then I found that my XML documents actually populate a source field called "xml", which is not documented anyway. source => "xml" seems to work.

Is there a lack in the documentation, or something I simply overlooked?

Michael

2

It is normal for events to contain a field called message (although there are exceptions). Events may also contain other fields, and nobody else can predict what other fields your events will contain. As a result, the examples in the documentation that require an input field tend to use "message" as the source. What else could they do?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.