I am migrated to Logstash 5.4 and running the conf with multiline plugin. its not working.
filter {
if [message] =~ "^<?xml .*" {
drop {}
}
multiline {
pattern => "^</response>"
negate => true
what => "next"
}
Please suggest workaround.
You are using the multiline filter, which has been deprecated. It is recommended that you perform multiline processing as close to the source as possible. If you are using Filebeat, configure multiline processing there. Otherwise use the Logstash multiline codec with your input.
Thanks but how would it help me i am wondering.
with previous versions of LS we desinged this LS configuration which was working perfectly:
input {
stdin { type => "C:/xampp/htdocs/logimport/pageAnalysis/results/demo/RUN21Jun2017122934/21Jun2017122934_170621_FV_HHB_Swissotel-Desktop_WebpageSummary.xml"
}
}
filter {
if [message] =~ "^<?xml ." {
drop {}
}
multiline {
pattern => "^</response>"
negate => true
what => "next"
}
xml {
source => "message"
target => "videoFrames"
store_xml => false
xpath => ["/response/data/run/firstView/videoFrames/frame[]/time/text()","Time_FV"]
xpath => ["/response/data/run/firstView/videoFrames/frame[]/image/text()","Image_FV"]
xpath => ["/response/data/run/firstView/videoFrames/frame[]/VisuallyComplete/text()","Progress_FV"]
xpath => ["/response/data/run/repeatView/videoFrames//frame[]/time/text()","Time_RV"]
xpath => ["/response/data/run/repeatView/videoFrames/frame[]/image/text()","Image_RV"]
xpath => ["/response/data/run/repeatView/videoFrames/frame[]/VisuallyComplete/text()","Progress_RV"]
xpath => ["/response/data/median/firstView/visualComplete/text()","FV_visualComplete"]
xpath => ["/response/data/median/firstView/lastVisualChange/text()","FV_lastVisualChange"]
xpath => ["/response/data/median/firstView/loadTime/text()","FV_loadTime"]
xpath => ["/response/data/median/firstView/fullyLoaded/text()","FV_fullyLoaded"]
xpath => ["/response/data/median/firstView/SpeedIndex/text()","FV_SpeedIndex"]
xpath => ["/response/data/median/firstView/TTFB/text()","FV_TTFB"]
xpath => ["/response/data/median/firstView/titleTime/text()","FV_titleTime"]
xpath => ["/response/data/median/firstView/render/text()","FV_startRender"]
xpath => ["/response/data/median/repeatView/visualComplete/text()","RV_visualComplete"]
xpath => ["/response/data/median/repeatView/lastVisualChange/text()","RV_lastVisualChange"]
xpath => ["/response/data/median/repeatView/loadTime/text()","RV_loadTime"]
xpath => ["/response/data/median/repeatView/fullyLoaded/text()","RV_fullyLoaded"]
xpath => ["/response/data/median/repeatView/SpeedIndex/text()","RV_SpeedIndex"]
xpath => ["/response/data/median/repeatView/TTFB/text()","RV_TTFB"]
xpath => ["/response/data/median/repeatView/titleTime/text()","RV_titleTime"]
xpath => ["/response/data/median/repeatView/render/text()","RV_startRender"]
xpath => ["/response/data/median/firstView/score_etags/text()","FV_score_etags"]
xpath => ["/response/data/median/firstView/score_compress/text()","FV_score_compress"]
xpath => ["/response/data/median/firstView/score_combine/text()","FV_score_combine"]
xpath => ["/response/data/median/firstView/score_minify/text()","FV_score_minify"]
xpath => ["/response/data/median/firstView/score_keep-alive/text()","FV_score_keep-alive"]
xpath => ["/response/data/median/firstView/score_cookies/text()","FV_score_cookies"]
xpath => ["/response/data/median/firstView/score_gzip/text()","FV_score_gzip"]
xpath => ["/response/data/median/firstView/score_cdn/text()","FV_score_cdn"]
xpath => ["/response/data/median/firstView/score_cache/text()","FV_score_cache"]
xpath => ["/response/data/median/repeatView/score_etags/text()","RV_score_etags"]
xpath => ["/response/data/median/repeatView/score_compress/text()","RV_score_compress"]
xpath => ["/response/data/median/repeatView/score_combine/text()","RV_score_combine"]
xpath => ["/response/data/median/repeatView/score_minify/text()","RV_score_minify"]
xpath => ["/response/data/median/repeatView/score_keep-alive/text()","RV_score_keep-alive"]
xpath => ["/response/data/median/repeatView/score_cookies/text()","RV_score_cookies"]
xpath => ["/response/data/median/repeatView/score_gzip/text()","RV_score_gzip"]
xpath => ["/response/data/median/repeatView/score_cdn/text()","RV_score_cdn"]
xpath => ["/response/data/median/repeatView/score_cache/text()","RV_score_cache"]
xpath => ["/response/data/median/firstView/docCPUms/text()","FV_docCPUms"]
xpath => ["/response/data/median/firstView/fullyLoadedCPUms/text()","FV_fullyLoadedCPUms"]
xpath => ["/response/data/median/firstView/docCPUpct/text()","FV_docCPUpct"]
xpath => ["/response/data/median/firstView/fullyLoadedCPUpct/text()","FV_fullyLoadedCPUpct"]
xpath => ["/response/data/median/repeatView/docCPUms/text()","RV_docCPUms"]
xpath => ["/response/data/median/repeatView/fullyLoadedCPUms/text()","RV_fullyLoadedCPUms"]
xpath => ["/response/data/median/repeatView/docCPUpct/text()","RV_docCPUpct"]
xpath => ["/response/data/median/repeatView/fullyLoadedCPUpct/text()","RV_fullyLoadedCPUpct"]
}
ruby {
code => "
##Finding max for splitting event for that many number of times
x= [event.get('Time_FV').length, event.get('Time_RV').length]
max= x.max
if event.get('Time_FV').length==max
event.set('flag','FV')
end
if event.get('Time_RV').length==max
event.set('flag','RV')
end
"
}
if [flag]=="FV" {
split { field => "Time_FV" }
}
if [flag]=="RV" {
split { field => "Time_RV" }
}
ruby {
code => "
my_variable = ENV['mycount3']
if my_variable.nil?
ENV['mycount3']=0.to_s
counter=0
else
counter=ENV['mycount3'].to_i
counter=counter+1
ENV['mycount3']=counter.to_s
end
if event.get('flag') == 'FV'
tfv=event.get('Time_RV')
event.set('TimeRV',tfv[counter])
end
if event.get('flag') == 'RV'
trv=event.get('Time_FV')
event.set('TimeFV',trv[counter])
end
pfv=event.get('Progress_FV')
prv=event.get('Progress_RV')
event.set('ProgressFV',pfv[counter])
event.set('ProgressRV',prv[counter])
##Extracting test id, run id and url from file name
filename = File.basename(event.get('type'), '.')
value = filename.split('')
event.set('Test_Id', value[0])
event.set('Run_Id', value[1] + '' + value[2] + '_' + value[3])
event.set('Keyword', value[4])
"
}
if [flag]=="FV" {
mutate {rename => { "Time_FV" => "TimeFV" }}
}
if [flag]=="RV" {
mutate {rename => { "Time_RV" => "TimeRV" }}
}
grok {match => ["type", "C:/xampp/htdocs/logimport/pageAnalysis/results/(?[^/]+)"]}
mutate {lowercase => [ "Project" ]}
}
output {
elasticsearch {
action => "index"
hosts => "localhost:9200"
index => "logstash-wpt-%{Project}-%{+YYYY.MM.dd}"
}
stdout {}
}
....
but due to deprecation it seems the entire pipeline went on toss. we cannot use 5.4.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.