Having a really hard time mutating XML Filter Results


(raswer) #1

figured it out xpath.


(raswer) #2

I tried mutating the index inside the elastic stack to avail.


(Walker) #3

I'm thinking your mutate conversion syntax is incorrect and possibly the field names. Looking at the documentation, try this syntax:

mutate {
  convert => {
    "[Info][0][RunDate] => "date"
    "[Info][1][ProcessingTime] => "float"
  }
}

I mention the field name's possibly being incorrect because you specify the target as being xml_content. This should change the field values to xml_content.Info.0.RunDate and xml_content.Info.1.ProcessingTime. If you have an output of what the data looks like from Kibana or the query results directly from Elasticsearch, we would know for sure.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.