How to check whether fields exist?How to access the data within it?

[JAYESH_PAUNIKAR]

We have an XML which we have parsed using the XML filter. Sample of the XML is as follows;

<?xml version="1.0" encoding="UTF-8"?>

We have parsed the XML using the XML filter in Logstash.
Following is the config file:

input{
file {
path => "C:\Users\Programs\ELK\logstash-6.2.3\logstash-6.2.3\xml data\results.xml"
start_position=>"beginning"
sincedb_path =>"/dev/null"
codec => multiline {
pattern => "^<?xml .*?>"
negate => "true"
what => "previous"
auto_flush_interval => 1
}

}

}
filter{
xml{
source => "message"
target => "xml_parsed"
}
}
output{
elasticsearch {
hosts => ["localhost:9200"]
index => "proto"
}
stdout{}
}

We wanted to find the name of the test case which has failed ( here test case having name G)
the test case having system-out passes and the test case having failure message fails. So we tried writing a script in painless but it does not work. Following is the script:

String scenario = "NA";
for(int i = 0; i < xml_parsed.testcase.length; i++){
if(xml_parsed.testcase[i].system-out == NULL)
return xml_parsed.testcase[i].name;
}
return scenario;

We tried doc['xml_parsed.testcase.keyword'] but xml_parsed.testcase.keyword does not exist i guess as it is not shown in the fields when the index pattern is created. In discover xml_parsed.testcase appears as follows;

{
"system-out": [
"S1.....................................passed\nS2..........................................................passed\nS3..........................................................passed"
],
"classname":"E",
"name": "F",
"time": "39.773916"
},
{
"failure": [
{
"message": "F1"
}
],
"classname": "E",
"name": "G",
"time": "37.785234"
}

So how to access the fields within an index in the array for example "name" in xml_parsed.testcase[0]?

[christophilus (Chris Davies)]

Hi Jayesh, It's hard to say, since the code you pasted got garbled. But if you're trying to ask: "How many documents have a testcase with name 'G'?" You can do this without needing array index access.

In Kibana's Dev Tools, you can do something like this:

GET .baz/_search
{
  "query": {
    "term": {
      "xml_parsed.testcase.name.keyword": "G"
    }
  }
}

[JAYESH_PAUNIKAR]

We have an XML which we have parsed using the XML filter. Sample of the XML is as follows;

<!?xml version="1.0" encoding="UTF-8"?>
<!testsuite failures="1" name="ABCD" skipped="0" tests="2" time="115.196272">
<!testcase classname="E" name="F" time="39.773916">
<!system-out><!/system-out>
<!/testcase>
<!testcase classname="E" name="G" time="37.785234">
<!failure message="F1"><!/failure>
<!/testcase>
<!/testsuite>"

Following is the config file:

input{
file {
path => "C:\Users\Programs\ELK\logstash-6.2.3\logstash-6.2.3\xml data\results.xml"
start_position=>"beginning"
sincedb_path =>"/dev/null"
codec => multiline {
pattern => "^<?xml .*?>"
negate => "true"
what => "previous"
auto_flush_interval => 1
}
}
}
filter{
xml{
source => "message"
target => "xml_parsed"
}
}
output{
elasticsearch {
hosts => ["localhost:9200"]
index => "proto"
}
stdout{}
}

We wanted to find the name of the test case which has failed ( here test case having name G).
The test case having <!system-out> passes and the test case having <!failure> message fails. So we tried writing a script in painless but it does not work. Following is the script:

String scenario = "NA";
for(int i = 0; i < xml_parsed.testcase.length; i++){
if(xml_parsed.testcase[i].system-out == NULL)
return xml_parsed.testcase[i].name;
}
return scenario;

We tried doc['xml_parsed.testcase.keyword'] but xml_parsed.testcase.keyword does not exist i guess as it is not shown in the fields when the index pattern is created. In discover xml_parsed.testcase appears as follows;

{
"system-out": [
"S1.....................................passed\nS2..........................................................passed\nS3..........................................................passed"
],
"classname":"E",
"name": "F",
"time": "39.773916"
},
{
"failure": [
{
"message": "F1"
}
],
"classname": "E",
"name": "G",
"time": "37.785234"
}

So how to access the fields within an index in the array for example "name" in xml_parsed.testcase[0]?
We want the name of the testcase which has failure field .here it is G but it can vary. So can you tell us how to do that in painless because we want to create a field and use that field to visualize.Have added ! inside the tags just to make it visible.