Can we parse XML data without giving xpath details using logstash?

[Shruti_Gupta1 (Shruti Gupta)]

Hi Team,

We are monitoring google apigee apiProxy messaging logs with ELK Stack. As we are not aware which fields will be sent by workflows in the request and response body of XML, We need help to understand how can we parse an XML without xpath details.

Thanks

[Badger]

If you use an xml filter with store_xml set to true and omit the xpath option then it will parse arbitrary XML structures.

[Shruti_Gupta1 (Shruti Gupta)]

Thanks Badger, When i am using below conf my logstash gets stuck.

input {
file {
path => "/etc/logstash/conf.d/file.xml"
start_position => beginning
sincedb_path => "/dev/null"
type => "xml"
codec => multiline {
pattern => "^<?Root .*>"
negate => true
what => "previous" }
} }
filter {
xml { source => "message" target => "theXML" store_xml => true }
output {
elasticsearch {
hosts => ["http://192.168.1.10:9200"]
index => "demo" } }