Hi,
I am using filebeat to read xml files from a directory and then feed it to logstash where it is filetered then sent out to elastic. I thought that perhaps when the pipeline gets created in the logstash config, it does the filebeat input and then passes it to the filter portion but perhaps not cause when I run the job I get:
filter {
xml {
source => # SETTING MISSING
...
}
}
My current config has:
input {
beats {
port => 5044
codec => multiline {
auto_flush_interval => 1
negate => "true"
pattern => "^<name=*\>"
what => "previous"
max_lines => 1000000000
max_bytes => "500 MiB"}}
}
filter {
xml {
store_xml => true
store_xml => false
target => "theXML"
force_array => false
}
mutate { replace => { "c_port" => "%{[theXML][c_port]}" } }
mutate { convert => { "c_port" => "integer" } }}
So Im curious if its not logically reading from input as SOURCE and I have to place A SOURCE statment in the filter section then what do I declare as the source? Would it be something like:
SOURCE => beats
?
Thank you.