How to parse space with xpath in logstash

Hi everyone. I try to parse space with xpath in logstash. My code works, but when this condition "///Sql_Text[text()[contains(.,'DROP'' '') or contains(.,'CREATE'\s'') see CREATED or DROPED it take it and i need to add single space after DROP,CREATE...
input {
beats {
port => 5044
filter {
xml {
remove_namespaces => "true"
store_xml => "false"
source => "message"
xpath => [
/Sql_Text[text()[contains(.,'DROP'' '') or contains(.,'CREATE\s') or contains(.,'ALTER')]]/text()","SQL_TEXT"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.