Having a really hard time mutating XML Filter Results

Elastic Stack Logstash
1

figured it out xpath.

2

I tried mutating the index inside the elastic stack to avail.

3

I'm thinking your mutate conversion syntax is incorrect and possibly the field names. Looking at the documentation, try this syntax:

mutate {
  convert => {
    "[Info][0][RunDate] => "date"
    "[Info][1][ProcessingTime] => "float"
  }
}

I mention the field name's possibly being incorrect because you specify the target as being xml_content. This should change the field values to xml_content.Info.0.RunDate and xml_content.Info.1.ProcessingTime. If you have an output of what the data looks like from Kibana or the query results directly from Elasticsearch, we would know for sure.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.