Is there any solution about using if condition in filter?
I want if there is some tags in xml source, do filter about xml, mutae, ruby , ect...
First, my xml source is like this :
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<m2m:cin xmlns:m2m="http://www.onem2m.org/xml/protocols" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<ty>4</ty>
<ri>CI00000000001244656716</ri>
<rn>CI00000000001244656716</rn>
<pi>CT00000000000000046769</pi>
<ct>2018-02-05T15:06:30+09:00</ct>
<lt>2018-02-05T15:06:30+09:00</lt>
<ppt>
<gwl>36.83115, 127.11185, 76</gwl>
<geui>0017b2fffe0ad93e</geui>
</ppt>
<sr>/0240771000000168/v1_0/remoteCSE-00000168000c05c016104807/container-LoRa//subscription-SS00000000000000261472</sr>
<et>2018-02-06T15:06:30+09:00</et>
<st>11785</st>
<cr>RC00000000000000050648</cr>
<cnf>LoRa/Sensor</cnf>
<cs>76</cs>
<con>010400003039499602d2499602d203e703e70000000003e703e70000000000000000fff51234</con>
</m2m:cin>
And my filter is like this :
filter {
if(....){
xml{
source => "message"
store_xml => false
xpath => ["/m2m:cin/sr", "parsedSr"]
xpath => ["/m2m:cin/con", "parsedCon"]
}
mutate{
gsub => ["parsedCon", "<[^<]*>", ""]
gsub => ["parsedSr", "<[^<]*>", ""]
remove_field => "headers"
remove_field => "@timestamp"
remove_field => "@version"
}
ruby{
path => "C:\workspace_server/parser.rb"
}
mutate {
remove_field => "parsedSr"
remove_field => "parsedCon"
}
}
}
I want if there are <con> and<sr> tags in xml source, do xml {..} ~ mutate {..}
How do I write in if condition ??