HI Team,
I'm just working on new type of XML file. I have some array information in that file i want to gather all those data.. This array fields are repeating with same tags due to this while processing the log the i'm getting empty array value and help me to concat all the value and store in a field. Please find the sample code for your refrerence
<_5:TelephoneCommunication>
<5:ChannelCode>Cell</5:ChannelCode>
<5:CompleteNumber>231</5:CompleteNumber>
<5:UseCode>Cell</5:UseCode>
xml code to extract the info,
HI magnus,
Actually im getting empty value on that field instead of that i want to get the repeated value in the array . For example,
you can find the field "ChannelCode" thrice in above my example, i want to capture all the three value in to respective field. This is what i want to do it.
currently getting
user_call_mode :[]
Expected Result
user_call_mode:"Day|Evening|Cell"
If the XML element begin with "5:" I'd expect you to have to include that in the XPath expression. If you provide the actual XML file (or parts of it) and the exact xml filter you use it'll be easier to help out. Make sure you format both as preformatted text when posting so that the forum software doesn't mangle the text.
what i mentioned is exact xml and when it not comes in array format its working fine and im getting event.
like this
<5:ChannelCode>Cell
<5:CompleteNumber>231
<5:UseCode>Cell
when my input is repeat more than once im facing this issue
What you posted contains no closing tags so it can't possibly be the exact same as your input. I'm trying to reproduce your problem but then I need to know exactly what your input looks like. You also haven't posted exactly what the resulting event looks like.
In the below sample i need to capture all the description text into one field how could i process it, Please find the below input
<_9:BODSuccessMessage>
<_9:WarningProcessMessage>
<_9:Description>/p:ProcessRepairOrderType[1]/p:ProcessRepairOrderDataArea[1]/p:RepairOrder[1]/p:Job[2]/p:OperationName[1] | Length must be up to 80 characters =>Node: OperationName | RO063</_9:Description>
<_9:ReasonCode>Invalid Required Value
</_9:ReasonCode>
</_9:WarningProcessMessage>
<_9:WarningProcessMessage>
<_9:Description>/p:ProcessRepairOrderType[1]/p:ProcessRepairOrderDataArea[1]/p:RepairOrder[1]/p:Job[2]/p:OperationName[1] | Length must be up to 80 characters =>Node: OperationName | RO063</_9:Description>
<_9:ReasonCode>Invalid Required Value</_9:ReasonCode>
</_9:WarningProcessMessage>
<_9:WarningProcessMessage>
<_9:Description>/p:ProcessRepairOrderType[1]/p:ProcessRepairOrderDataArea[1]/p:RepairOrder[1]/p:Job[2]/p:CodesAndCommentsExpanded[1]/p:TechnicianNotes[1] | Format Error. Length must be up to 255 characters =>Node: TechnicianNotes | RO072</_9:Description>
<_9:ReasonCode>Invalid Required Value</_9:ReasonCode>
</_9:WarningProcessMessage>
<_9:WarningProcessMessage>
<_9:Description>/p:ProcessRepairOrderType[1]/p:ProcessRepairOrderDataArea[1]/p:RepairOrder[1]/p:Job[2]/p:ServiceLabor[1]/p:LaborOperationDescription[1] | Length must be up to 80 characters =>Node: LaborOperationDescription | RO087</_9:Description>
<_9:ReasonCode>Invalid Required Value</_9:ReasonCode>
</_9:WarningProcessMessage>
</_9:BODSuccessMessage>
This is clumsy and will not work if you have other Description elements in your document besides these in the "_9" namespace. It seems the xml filter allows you to register namespaces with the namespaces option, which would be preferable and would allow you to write a more exact XPath expression.
<_5:ConfirmBOD releaseID="5.4.4">
<_5:ConfirmBODDataArea>
<_5:BOD>
<_9:BODSuccessMessage>
<_9:WarningProcessMessage>
<_9:Description>/p:ProcessRepairOrderType[1]/p:ProcessRepairOrderDataArea[1]/p:RepairOrder[1]/p:Job[1]/p:CodesAndCommentsExpanded[1]/p:TechnicianNotes[1] | Format Error. Length must be up to 255 characters =>Node: TechnicianNotes | RO072
<_9:ReasonCode>Invalid Required Value
<_9:WarningProcessMessage>
<_9:Description>/p:ProcessRepairOrderType[1]/p:ProcessRepairOrderDataArea[1]/p:RepairOrder[1]/p:Job[2]/p:OperationName[1] | Length must be up to 80 characters =>Node: OperationName | RO063
<_9:ReasonCode>Invalid Required Value
<_9:WarningProcessMessage>
<_9:Description>/p:ProcessRepairOrderType[1]/p:ProcessRepairOrderDataArea[1]/p:RepairOrder[1]/p:Job[2]/p:CodesAndCommentsExpanded[1]/p:TechnicianNotes[1] | Format Error. Length must be up to 255 characters =>Node: TechnicianNotes | RO072
<_9:ReasonCode>Invalid Required Value
<_9:WarningProcessMessage>
<_9:Description>/p:ProcessRepairOrderType[1]/p:ProcessRepairOrderDataArea[1]/p:RepairOrder[1]/p:Job[2]/p:ServiceLabor[1]/p:LaborOperationDescription[1] | Length must be up to 80 characters =>Node: LaborOperationDescription | RO087
<_9:ReasonCode>Invalid Required Value
At least my Logstash complains about the CONCAT stuff in the XPath expression. When I remove that and return to what I gave you earlier, it works as expected:
...
"response_desc" => [
[0] "/p:ProcessRepairOrderType[1]/p:ProcessRepairOrderDataArea[1]/p:RepairOrder[1]/p:Job[1]/p:CodesAndCommentsExpanded[1]/p:TechnicianNotes[1] | Format Error. Length must be up to 255 characters =>Node: TechnicianNotes | RO072",
[1] "/p:ProcessRepairOrderType[1]/p:ProcessRepairOrderDataArea[1]/p:RepairOrder[1]/p:Job[2]/p:OperationName[1] | Length must be up to 80 characters =>Node: OperationName | RO063"
]
...
I'm out of patience. This is my last response in this thread.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.