Can we parse XML data without giving xpath details using logstash?

Hi Team,

We are monitoring google apigee apiProxy messaging logs with ELK Stack. As we are not aware which fields will be sent by workflows in the request and response body of XML, We need help to understand how can we parse an XML without xpath details.


If you use an xml filter with store_xml set to true and omit the xpath option then it will parse arbitrary XML structures.

Thanks Badger, When i am using below conf my logstash gets stuck.

input {
file {
path => "/etc/logstash/conf.d/file.xml"
start_position => beginning
sincedb_path => "/dev/null"
type => "xml"
codec => multiline {
pattern => "^<?Root .*>"
negate => true
what => "previous" }
} }
filter {
xml { source => "message" target => "theXML" store_xml => true }
output {
elasticsearch {
hosts => [""]
index => "demo" } }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.