How ot deal with empty field in xml parser?

[rajsolanki (rajesh)]

i m sorry if this is repeat question. I m struggling with xml having empty values.

I m using logstash 7.5.1 XML filter. Here is my config.

##Input section

input
{
    file
        {
            path => "/tmp/test.xml"
            start_position => "beginning"
            sincedb_path => "/dev/null"
            type => "xml"
            codec => multiline {
                    pattern => "<?xml "
                    negate => "true"
                    what => "previous"
                }
        }
}


##Filter section

filter {

    xml{
        source => "message"
        store_xml => false
        target => "root"
        xpath => [
            "/root/fname/text()", "FName",
            "/root/lname/text()", "LName",
            "/root/age/text()", "Age",
            "/root/exp/text()", "Exp"
        ]
    }

     mutate {
            replace => [
                  "FName" , "%{[FName][0]}",
                  "LName" , "%{[LName][0]}",
                  "Age" , "%{[Age][0]}",
                  "Exp" , "%{[Exp][0]}"
                  ]
        }


}

##Output section
output {

stdout
        {
           codec => rubydebug
        }
}

Here is my XML

<?xml version="1.0" encoding="UTF-8"?>
<root>
    <fname>raj</fname>
    <lname>solanki</lname>
    <age>001</age>
    <exp>9</exp>
</root>

~

here is my output

{
          "type" => "xml",
    "@timestamp" => 2020-01-30T17:12:43.186Z,
          "tags" => [
        [0] "multiline"
    ],
       "message" => "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<root>\n    <fname>raj</fname>\n    <lname>solanki</lname>\n    <age>001</age>\n    <exp>9</exp>\n</root>",
           "Age" => "001",
           "Exp" => "9",
          "path" => "/tmp/test.xml",
      "@version" => "1",
         "FName" => "raj",
         "LName" => "solanki"
}

Now if i have document which doesn't have any values i.e no value for Exp

<?xml version="1.0" encoding="UTF-8"?>
<root>
    <fname>raj</fname>
    <lname>solanki</lname>
    <age>001</age>
    <exp></exp>
</root>

output

{
           **"Exp" => "%{[Exp][0]}",**
         "FName" => "raj",
         "LName" => "solanki",
       "message" => "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<root>\n    <fname>raj</fname>\n    <lname>solanki</lname>\n    <age>001</age>\n    <exp></exp>\n</root>",
           "Age" => "001",
          "path" => "/tmp/test.xml",
          "tags" => [
        [0] "multiline"
    ],
    "@timestamp" => 2020-01-30T17:15:53.099Z,

      "@version" => "1",
          "type" => "xml"
}

so how to assign value only if element has a value ? I did try

if [Exp][0] {}
and if [Exp][0] != "" {}

[Badger]

If the element is empty then it does not add a field to the event. So you just check if the field exists before doing the replacement

if [FName] { mutate { replace => { "FName" => "%{[FName][0]}" } } }
if [LName] { mutate { replace => { "LName" => "%{[LName][0]}" } } }
if [Age] { mutate { replace => { "Age" => "%{[Age][0]}" } } }
if [Exp] { mutate { replace => { "Exp" => "%{[Exp][0]}" } } }

[rajsolanki (rajesh)]

thanks a lot !