Filter data logstash error

Elastic Stack Logstash
1 
<recorddata>
    <logrecordappdata>
        <atmevent>
            <eventcode>1234</eventcode>
            <worksation_id>123</worksation_id>
            <timestamp>2017/01/21</timestamp>
            <description>sampleevent</description>
            <event_data>
                <status>up</status>
                <previous_status>unknown</previous_status>
                <reason>na</reason>
                <devices>
                    <device>
                        <device_id>12</device_id>
                        <device_type>type1</device_type>
                        <status>1</status>
                        <error_code>0</error_code>
                        <severity>low</severity>
                        <etended_error_code>0</etended_error_code>
                        <atrributes>
                            <attribute>
                                <name>atm1</name>
                                <value>1</value>
                            </attribute>
                        </atrributes>
                    </device>
                     </devices>
            </event_data>
        </atmevent>
    </logrecordappdata>
</recorddata>

My code is

input {
file {
path => "/var/log/atm_logs/satm5.xml"
start_position => "beginning"
}
}

filter {
xml {
store_xml => false
source => "message"
xpath =>
[
"/recorddata/logrecordappdata/atmevent/eventcode/text()", "atm_eventcode",
"/recorddata/logrecordappdata/atmevent/worksation_id/text()", "atm_wrkstid",
"/recorddata/logrecordappdata/atmevent/timestamp/text()", "atm_tmestamp",
"/recorddata/logrecordappdata/atmevent/description/text()", "atm_desc",
"/recorddata/logrecordappdata/atmevent/event_data/status/text()", "event_status",
"/recorddata/logrecordappdata/atmevent/event_data/previous_status/text()", "event_prev_status",
"/recorddata/logrecordappdata/atmevent/event_data/reason/text()", "event_reason",
"/recorddata/logrecordappdata/atmevent/event_data/devices/device/device_id/text()", "device_id",
"/recorddata/logrecordappdata/atmevent/event_data/devices/device/device_type/text()", "device_type",
"/recorddata/logrecordappdata/atmevent/event_data/devices/device/status/text()", "device_status",
"/recorddata/logrecordappdata/atmevent/event_data/devices/device/error_code/text()", "device_error_code",
"/recorddata/logrecordappdata/atmevent/event_data/devices/device/severity/text()", "device_severity",
"/recorddata/logrecordappdata/atmevent/event_data/devices/device/etended_error_code/text()", "device_etend_code",
"/recorddata/logrecordappdata/atmevent/event_data/devices/device/atrributes/atrribute/name/text()", "attr_name",
"/recorddata/logrecordappdata/atmevent/event_data/devices/device/atrributes/atrribute/value/text()", "attr_value"
]
}

}

output
{
elasticsearch
{
action => "index"
hosts => ["192.168.1.19:9200"]
index => "cmplx_xml_tags"
}
stdout
{
codec => rubydebug
}
}

....................................................................................................Error.....................................
Error i am not getting desired output please help me out in this

   "message" => "                     </devices>",
  "@version" => "1",
"@timestamp" => "2017-02-06T14:29:05.372Z",
      "path" => "/var/log/atm_logs/satm5.xml",
      "host" => "lslave6.hdp.com"

}
{
"message" => " </event_data>",
"@version" => "1",
"@timestamp" => "2017-02-06T14:29:05.372Z",
"path" => "/var/log/atm_logs/satm5.xml",
"host" => "lslave6.hdp.com"
}
{
"message" => " ",
"@version" => "1",
"@timestamp" => "2017-02-06T14:29:05.373Z",
"path" => "/var/log/atm_logs/satm5.xml",
"host" => "lslave6.hdp.com"
}
{

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.