If you have both occurrences in the same document you will get a mapping error when Elasticsearch tries to create mappings for it. What does the document look like?
Hi Christian,
My document is a (simplified version) of an NMAP xml output.
The problem is when try to parse the second script element in port 443, but I don't know how to solve it.
Thanks a lot!
Regards
Ana
LS Conf (Filter)
filter {
xml { source => "message"
target => poc
xpath => ["host/address/@addr", ip]
xpath => ["host/status/@state", state]
xpath => ["host/status/@reason", reason]
}
if [message] =~ /^<host starttime/ {
split {
field => "[poc][ports][0][port]"
}
}
if [message] =~ /^<task/ {
drop { }
}
}
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.