How can I use if condition in filter for xml

Is there any solution about using if condition in filter?

I want if there is some tags in xml source, do filter about xml, mutae, ruby , ect...

First, my xml source is like this :

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<m2m:cin xmlns:m2m="http://www.onem2m.org/xml/protocols" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<ty>4</ty>
<ri>CI00000000001244656716</ri>
<rn>CI00000000001244656716</rn>
<pi>CT00000000000000046769</pi>
<ct>2018-02-05T15:06:30+09:00</ct>
<lt>2018-02-05T15:06:30+09:00</lt>
<ppt>
<gwl>36.83115, 127.11185, 76</gwl>
<geui>0017b2fffe0ad93e</geui>
</ppt>
<sr>/0240771000000168/v1_0/remoteCSE-00000168000c05c016104807/container-LoRa//subscription-SS00000000000000261472</sr>
<et>2018-02-06T15:06:30+09:00</et>
<st>11785</st>
<cr>RC00000000000000050648</cr>
<cnf>LoRa/Sensor</cnf>
<cs>76</cs>
<con>010400003039499602d2499602d203e703e70000000003e703e70000000000000000fff51234</con>
</m2m:cin>

And my filter is like this :

filter {
	if(....){
		xml{
			source => "message"
        	store_xml => false        
        	xpath => ["/m2m:cin/sr", "parsedSr"]
			xpath => ["/m2m:cin/con", "parsedCon"]

   		}	
    	mutate{
			gsub => ["parsedCon", "<[^<]*>", ""]
			gsub => ["parsedSr", "<[^<]*>", ""]		
			remove_field => "headers" 
			remove_field => "@timestamp" 
			remove_field => "@version" 
		}

		ruby{
    		path => "C:\workspace_server/parser.rb"
		}

		mutate {
			remove_field => "parsedSr"
			remove_field => "parsedCon"
		}
	}

}        

I want if there are <con> and<sr> tags in xml source, do xml {..} ~ mutate {..}

How do I write in if condition ??

Use an xml filter with store_xml => true to parse the XML completely. Then you can access the whole XML structure via fields. If you use a stdout { codec => rubydebug } output to dump the raw event produced by Logstash it'll be easier to help.

I'm assuming after it's ingested the data will be present as a string in the [message] field. Not sure if @magnusbaeck's method is faster than this but I think this would work too.

if [message] =~ "(<con>|<sr>)" {
  do stuff
}

Thank you for your reply @wwalker

I added your solution like this :

filter {

	xml{
		source => "message"
        store_xml => true
       	target => "parsedData"        
       	xpath => ["/m2m:cin/sr", "parsedSr"]
		xpath => ["/m2m:cin/con", "parsedCon"]
	}

    mutate{
		gsub => ["parsedCon", "<[^<]*>", ""]
		gsub => ["parsedSr", "<[^<]*>", ""]		
		remove_field => "headers" 
		remove_field => "@timestamp" 
		remove_field => "@version" 
	}

	ruby{
    	path => "C:\workspace_server/parser.rb"
	}

	mutate {
		remove_field => "parsedSr"
		remove_field => "parsedCon"
	}

	if[message] =~ "(<con>|<sr>)" {
		do stuff
	}

}

But there is an error. It can be checked by console.

[2018-04-09T09:19:18,557][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Expected one of #, { at line 35, column 6 (byte 571) after filter {\n\n\txml{\n\t\tsource => "message"\n store_xml => true\n \ttarget => "parsedData" \n \txpath => ["/m2m:cin/sr", "parsedSr"]\n\t\txpath => ["/m2m:cin/con", "parsedCon"]\n\t}\n\n mutate{\n\t\tgsub => ["parsedCon", "<[^<]>", ""]\n\t\tgsub => ["parsedSr", "<[^<]>", ""]\t\t\n\t\tremove_field => "headers" \n\t\tremove_field => "@timestamp" \n\t\tremove_field => "@version" \n\t}\n\n\truby{\n \tpath => "C:\workspace_server/parser.rb"\n\t}\n\n\tmutate {\n\t\tremove_field => "parsedSr"\n\t\tremove_field => "parsedCon"\n\t}\n\n\tif[message] =~ "(|)" {\n\t\tdo ", :backtrace=>["C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/compiler.rb:42:in compile_imperative'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/compiler.rb:50:incompile_graph'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/compiler.rb:12:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/compiler.rb:11:in compile_sources'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:51:ininitialize'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline_action/reload.rb:34:in execute'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:315:inblock in converge_state'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:141:in with_pipelines'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:312:inblock in converge_state'", "org/jruby/RubyArray.java:1734:in each'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:299:inconverge_state'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:166:in block in converge_state_and_update'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:141:inwith_pipelines'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:164:in converge_state_and_update'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:105:inblock in execute'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/interval.rb:18:in interval'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:94:inexecute'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/runner.rb:348:in block in execute'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:inblock in initialize'"]}

Thank you for your reply @magnusbaeck.

I set up store_xml => true and target => "parsedData" .

My filter is like this:

filter {

xml{
	source => "message"
    store_xml => true
   	target => "parsedData"        
   	xpath => ["/m2m:cin/sr", "parsedSr"]
	xpath => ["/m2m:cin/con", "parsedCon"]
}

mutate{
	gsub => ["parsedCon", "<[^<]*>", ""]
	gsub => ["parsedSr", "<[^<]*>", ""]		
	remove_field => "headers" 
	remove_field => "@timestamp" 
	remove_field => "@version" 
}

ruby{
	path => "C:\workspace_server/parser.rb"
}

mutate {
	remove_field => "parsedSr"
	remove_field => "parsedCon"
}

}

So I can see whole XML structure.

{
"message" => "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\r\n<m2m:cin xmlns:m2m="http://www.onem2m.org/xml/protocols" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">\r\n4\r\nCI00000000001244656716\r\nCI00000000001244656716\r\nCT00000000000000046769\r\n2018-02-05T15:06:30+09:00\r\n2018-02-05T15:06:30+09:00\r\n\r\n36.83115, 127.11185, 76\r\n0017b2fffe0ad93e\r\n\r\n/0240771000000168/v1_0/remoteCSE-00000168000c05c016104807/container-LoRa//subscription-SS00000000000000261472\r\n2018-02-06T15:06:30+09:00\r\n11785\r\nRC00000000000000050648\r\nLoRa/Sensor\r\n76\r\n010400003039499602d2499602d203e703e70000000003e703e70000000000000000fff51234\r\n</m2m:cin>",
"LoraID" => "00000168000c05c016104807",
"parsedData" => {
"st" => [
[0] "11785"
],
"ppt" => [
[0] {
"geui" => [
[0] "0017b2fffe0ad93e"
],
"gwl" => [
[0] "36.83115, 127.11185, 76"
]
}
],
"cr" => [
[0] "RC00000000000000050648"
],
"xmlns:xsi" => "http://www.w3.org/2001/XMLSchema-instance",
"sr" => [
[0] "/0240771000000168/v1_0/remoteCSE-00000168000c05c016104807/container-LoRa//subscription-SS00000000000000261472"
],
"xmlns:m2m" => "http://www.onem2m.org/xml/protocols",
"cs" => [
[0] "76"
],
"et" => [
[0] "2018-02-06T15:06:30+09:00"
],
"con" => [
[0] "010400003039499602d2499602d203e703e70000000003e703e70000000000000000fff51234"
],
"rn" => [
[0] "CI00000000001244656716"
],
"lt" => [
[0] "2018-02-05T15:06:30+09:00"
],
"pi" => [
[0] "CT00000000000000046769"
],
"ct" => [
[0] "2018-02-05T15:06:30+09:00"
],
"cnf" => [
[0] "LoRa/Sensor"
],
"ty" => [
[0] "4"
],
"ri" => [
[0] "CI00000000001244656716"
]
},
"host" => "0:0:0:0:0:0:0:1",
"output_result" => {
"inv_tp" => 1234567890,
"err_sw" => "0001001000110100",
"inv_cp" => 12345,
"in_ia" => 999,
"out_it" => 0,
"out_ir" => 999,
"out_vt" => 0,
"inverter" => 4,
"energy" => 1,
"out_vs" => 0,
"out_vr" => 999,
"out_is" => 0,
"in_va" => 999,
"in_vb" => 0,
"err_hw" => "1111111111110101",
"in_ib" => 0,
"inv_dp" => 1234567890
}
}

So, what should I add if condition next?

So, what should I add if condition next?

This checks whether the XML contained an sr element:

if [parsedData][sr] {

But why not just extract the sr and con elements with an xml filter (without store_xml enabled but with the xpath option you've already set) and check the resulting fields?

@magnusbaeck Thank you so mush!

I use if condition in output like this :

output {
	if([parsedData][con] and [parsedData][sr]){
		elasticsearch {
			index => "parse"
			hosts => "localhost:9200"
		}
	}

	if([output_result][energy] == 1 and [output_result][inverter] == 4){
		stdout {	
			codec => rubydebug
		}
	}
} 

It's work correctly..
And I want to know one more information..
Can I check the input sorce is xml or not?

Can I check the input sorce is xml or not?

You could use a regexp-based conditional, but I'd probably just try feeding it to the xml filter and see if Logstash tags it with _xmlparsefailure.

@magnusbaeck Thank you for your reply!

Because I ask this question, if the input source is not xml source, Logstash's connect has been broken.

Because I ask this question, if the input source is not xml source, Logstash's connect has been broken.

I don't understand what you mean.

@magnusbaeck
Um.. I send the xml source to logstash by Postman. If the xml source's structure is accurate, Logstash works well. But if I send the xml source like this :

<?xml version="1.0" encoding="UTF-8" standalone="yes"? dd>

At the end of character 'dd' is not accurate structure of XML.
If this source is sent to Logstash, Logstash's connection will be broken. The Error is like this :

[2018-04-09T15:20:30,324][ERROR][logstash.pipeline ] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.

Really? Please show more of the log. The xml filter shouldn't stall the pipeline.

@magnusbaeck

Ok.. I show you full log.

[2018-04-09T15:50:54,973][ERROR][logstash.pipeline ] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline_id=>"main", "exception"=>"/m2m:cin/sr", "backtrace"=>["nokogiri/XmlXpathContext.java:130:in evaluate'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:198:inxpath_impl'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:179:in xpath_internal'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:154:inxpath'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:153:in block in filter'", "org/jruby/RubyHash.java:1343:ineach'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:152:in filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:145:indo_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:164:in block in multi_filter'", "org/jruby/RubyArray.java:1734:ineach'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:161:in multi_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filter_delegator.rb:47:inmulti_filter'", "(eval):127:in block in filter_func'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:447:infilter_batch'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:426:in worker_loop'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:385:inblock in start_workers'"], :thread=>"#<Thread:0x48c92bf sleep>"}
[2018-04-09T15:50:57,058][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<Nokogiri::XML::XPath::SyntaxError: /m2m:cin/sr>, :backtrace=>["nokogiri/XmlXpathContext.java:130:in evaluate'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:198:inxpath_impl'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:179:in xpath_internal'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:154:inxpath'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:153:in block in filter'", "org/jruby/RubyHash.java:1343:ineach'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:152:in filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:145:indo_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:164:in block in multi_filter'", "org/jruby/RubyArray.java:1734:ineach'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:161:in multi_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filter_delegator.rb:47:inmulti_filter'", "(eval):127:in block in filter_func'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:447:infilter_batch'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:426:in worker_loop'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:385:inblock in start_workers'"]}
[2018-04-09T15:50:57,110][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit
2018-04-09 15:50:57 +0900: Listen loop error: #<IOError: closed stream>
org/jruby/RubyIO.java:3405:in select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:inhandle_servers'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in block in run' 2018-04-09 15:50:57 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:inselect'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:inblock in run'
2018-04-09 15:50:57 +0900: Listen loop error: #<IOError: closed stream>
org/jruby/RubyIO.java:3405:in select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:inhandle_servers'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in block in run' 2018-04-09 15:50:57 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:inselect'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:inblock in run'
2018-04-09 15:50:57 +0900: Listen loop error: #<IOError: closed stream>
C:\logstash-6.2.3\logstash-6.2.3\bin>

The problem is with your XPath syntax. Perhaps you can work around this by setting remove_namespaces to true? Otherwise I don't know.

@magnusbaeck Thank you for your reply.

I don't set remove_namespaces to true.
But if I set that to true just now, Logstash's connect is broke by accurate xml source .

The Error is like this :

[2018-04-09T16:14:14,885][ERROR][logstash.pipeline ] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline_id=>"main", "exception"=>"/m2m:cin/sr", "backtrace"=>["nokogiri/XmlXpathContext.java:130:in evaluate'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:198:inxpath_impl'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:179:in xpath_internal'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:154:inxpath'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:153:in block in filter'", "org/jruby/RubyHash.java:1343:ineach'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:152:in filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:145:indo_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:164:in block in multi_filter'", "org/jruby/RubyArray.java:1734:ineach'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:161:in multi_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filter_delegator.rb:47:inmulti_filter'", "(eval):127:in block in filter_func'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:447:infilter_batch'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:426:in worker_loop'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:385:inblock in start_workers'"], :thread=>"#<Thread:0x2a4dd939 sleep>"}
[2018-04-09T16:14:14,907][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<Nokogiri::XML::XPath::SyntaxError: /m2m:cin/sr>, :backtrace=>["nokogiri/XmlXpathContext.java:130:in evaluate'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:198:inxpath_impl'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:179:in xpath_internal'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:154:inxpath'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:153:in block in filter'", "org/jruby/RubyHash.java:1343:ineach'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:152:in filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:145:indo_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:164:in block in multi_filter'", "org/jruby/RubyArray.java:1734:ineach'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:161:in multi_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filter_delegator.rb:47:inmulti_filter'", "(eval):127:in block in filter_func'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:447:infilter_batch'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:426:in worker_loop'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:385:inblock in start_workers'"]}
2018-04-09 16:14:14 +0900: Listen loop error: #<IOError: closed stream>
org/jruby/RubyIO.java:3022:in read' org/jruby/RubyIO.java:2993:inread'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:376:in handle_check' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:325:inblock in handle_servers'
org/jruby/RubyArray.java:1734:in each' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:323:inhandle_servers'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run'

This is another error

[2018-04-09T16:14:14,955][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit
2018-04-09 16:14:14 +0900: Listen loop error: #<IOError: closed stream>
org/jruby/RubyIO.java:3405:in select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:inhandle_servers'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in block in run' 2018-04-09 16:14:14 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:inselect'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:inblock in run'
2018-04-09 16:14:14 +0900: Listen loop error: #<IOError: closed stream>
org/jruby/RubyIO.java:3405:in select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:inhandle_servers'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in block in run' 2018-04-09 16:14:15 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:inselect'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:inblock in run'
2018-04-09 16:14:15 +0900: Listen loop error: #<IOError: closed stream>
org/jruby/RubyIO.java:3405:in select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:inhandle_servers'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in block in run' 2018-04-09 16:14:15 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:inselect'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:inblock in run'
2018-04-09 16:14:15 +0900: Listen loop error: #<IOError: closed stream>
org/jruby/RubyIO.java:3405:in select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:inhandle_servers'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in block in run' 2018-04-09 16:14:15 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:inselect'
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:inblock in run'
2018-04-09 16:14:15 +0900: Listen loop error: #<IOError: closed stream>

With remove_namespaces enabled you should remove "m2m:" from your XPath expression so it boils down to /cin/sr.

@magnusbaeck
Oh.. Thank you very much! It works well.
And I found namespaces plugins. So, I change code like this :

filter {
	xml{	
		namespaces => {
			"xmlns:m2m" => "http://www.onem2m.org/xml/protocols"
			"xmlns:xsi" => "http://www.w3.org/2001/XMLSchema-instance"
		}
		source => "message"
        store_xml => true
       	target => "parsedData"     
       	xpath => ["/m2m:cin/sr", "parsedSr"]
       	xpath => ["/m2m:cin/con", "parsedCon"]
	}

It works same with remove_namespaces?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.