Help parsing Xml File

Elastic Stack Logstash
1

Hello,

I tried to format my xml in ES.

Xml Format :

<PlaceList xmlns="http://places.maps.here.com/pds">
        <Place xmlns="http://places.maps.here.com/pds">
            <Identity isDeleted="false" lastUpdatedTimeStamp="2018-09-02T21:45:09.677Z">
                <PlaceId>250u03q7-235079d2a6cf494498fd36608f3cf81d</PlaceId>
                <QualityLevel>5</QualityLevel>
            </Identity>
        </Place>
        <Place xmlns="http://places.maps.here.com/pds">
            <Identity isDeleted="false" lastUpdatedTimeStamp="2018-09-23T06:30:00.974Z">
                <PlaceId>250spg6q-f9672d4b2c1f41209cd2f038d26a93ef</PlaceId>
                <QualityLevel>4</QualityLevel>             
            </Identity>
        </Place>
    </PlaceList>

I tried with config :

input {  {
    file
    {
    codec => multiline 
                {
                  pattern => "<PlaceList>" 
                  negate => "true"
                  what => "previous"
                }
            }}

filter {
          xml {
            source => "message"
            store_xml => "false"
            xpath => ["/PlaceList//Place", "places"]    
          }

split {
            field => "places"
          }

xml {
            source => "places"
            store_xml => "false"
            xpath => ["/Place/Identity/PlaceId/text()", "place_id"]
            remove_field => [ "places" ]
          }
        }

It's failed if i use the split : field:places is of type = NilClass.

If I comment the split and the last xml, I have no result,

The "message" field contains well the xml from beginning to the end.

Lucio

2

Interesting, never thought to "stack" the XML filter. Try changing your first XML config to the below, see what that gets you:

xml {
  source => "message"
  store_xml => "false"
  xpath => [ "/PlaceList/Place/text()", "places"]
}

I feel like that is still going to throw some sort of error though. If the PlaceList node isn't necessary, you could modify your multiline codec to stick everything matching <place on the same line instead and then use that as your root node in the XML pathing.

3

hope this helps you,

4

The pb was the xmlns attribute. I had to add the namespace.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.