Filter XML plugin namespace available?

Elastic Stack Logstash
1

When using the namespace => { or the remove_namespace I don't get any positive response when wanting to assign or remove the namespace, since I am getting this error
Error parsing xml with XmlSimple
<REXML::UndefinedNamespaceException: Undefined prefix log4j found>
I'm new and I don't know if I'm using the xml correctly

MY LOG:

<log4j:event logger="LogGeneratorApp.MainForm" timestamp="1662748734048" level="INFO" thread="1">log4j:messageThis is a test log message</log4j:message>log4j:properties<log4j:data name="log4net:UserName" value="TE\60085367" /><log4j:data name="log4jmachinename" value="TAMP00043541" /><log4j:data name="log4japp" value="LogGeneratorApp.exe" /><log4j:data name="log4net:HostName" value="TAMP00043541" /></log4j:properties><log4j:locationInfo class="LogGeneratorApp.MainForm" method="SendToLog" file="" line="0" /></log4j:event>

MY Filter LOGSTASH.CONF


filter{
xml{
source => "message"
target => "doc"
xpath => [ "/log4j:event/log4j:message/text()","messageM" ]
namespaces => {"log4j" => "http://jakarta.apache.org/log4j/"}
#remove_namespaces => false
#store_xml => false
}
}

A solution for this problem that I found is to make use of:
filter { mutate { gsub => [ 'message', 'values to modify','value modified' ] }}

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.