How to parse data in message into separate fields

This is my data in KIbana

input {
  http_poller {
    urls => {
      soap_request => {
					method => post
					url => "URL deleted"
		headers => {
					"Content-Type" => "text/xml; charset=utf-8"
					"SOAPAction" => "URL deleted"
					}
        body => '<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:req="http://localhost/request">
					   <soap:Header/>
					   <soap:Body>
						  <req:GetDocuments>
							 <req:Date1>2019-08-01</req:Date1>
							 <req:Date2>2019-08-31</req:Date2>
						  </req:GetDocuments>
					   </soap:Body>
					</soap:Envelope>'
		auth => {
				user => "1"
				password => "1"
				}
			  }
			}
		schedule => { cron => "* * * * * UTC"}
				request_timeout => 60
				 codec => multiline {
			pattern => "<m:Document>" 
            what => "previous"
			}
										
		}
	}
	
	filter {
     xml {
        source => "message"
		target => "xmldata"
        store_xml => false
        xpath => [
            "//Status/text()", "Status",
			"//Number/text()", "Number",
			"//Tip/text()", "Tip",
			"//m:DataDoc/text()", "Data"
			         ]
    }
}
		
output {
    elasticsearch {
        hosts => ['localhost:9200']
        index => "xml222"
    }
    stdout {
        codec => rubydebug
    }
}

This is my Logstash config but it is doesn't work

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.