How to parse this xml data each rate plan id data should go to new row or new column dynamically by using xml filter xpath option or any other solution let me know please (edited)

my logstash

input { beats { port => 5044 } }
filter {
mutate {
split => { "message" => "@$@" }}

mutate {
add_field => { "response" => "%{[message][1]}" "request" => "%{[message][0]}" } }

xml { store_xml => "false" source => "response" target => "xmldata"

xpath =>[
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/@id","ratePlan id",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/roomDetails/roomTypeCode/metricValue/text()","roomTypeCode",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/roomDetails/hhRoomType/text()","hhRoomType",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/roomDetails/hhBedTypes/hhBedType/text()","hhBedTypes",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/rateDetails/rateTypeCode/text()","rateTypeCode",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/rateDetails/breakfastIncluded/text()","breakfastincluded",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/rateDetails/nonRefundable/text()","nonRefundable",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/roomRateDetails/roomRateCode/text()","roomRateCode",
"/propertyAvailability/hotelRates/hotel/bookingChannel/@type","bookingChannel"

] } }

output { elasticsearch { hosts => ["http://localhost:9200"] index => "hotelhubatpingdev" } }

my file beat

filebeat.inputs:

  • type: log

    enabled: true

    paths:

    • D:\HotelHub\ATPI\OHHPayload**.txt

filebeat.config.modules:

path: ${path.config}/modules.d/*.yml

reload.enabled: false

setup.template.settings:
index.number_of_shards: 1

setup.kibana:

host: "192.168.100.136:5601"

output.logstash:

hosts: ["192.168.100.136:5044"]

processors:

  • add_host_metadata: ~
  • add_cloud_metadata: ~
  • add_docker_metadata: ~
  • add_kubernetes_metadata: ~

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.