How to remove the root element while xml parsing using Logstash?

Elastic Stack Logstash
1

My sample XML structure is as below:

  <Order BillToID="123">
  <PersonInfo Address="abc"></PersonInfo>
  <OrderLines>
  <OrderLine DeliveryMethod="xyz"></OrderLine>
  </OrderLines>
  </Order>

With the below code:

   xml {
		source => "message"
		store_xml => true
		target => "order"
		force_array => false
	}

I can achieve something like this:

Output Received in Elastic
"hits": [
{
"_index": "order",
"_type": "order",
"_id": "123",
"_score": 1,
"_source": {
"order": {
"BillToID": "123",
"PersonInfo": {
"ShipNode": "53"
}
"OrderLines": {
"OrderLine" : [
{
"DeliveryMethod": "xyz"
}
]
}
}
]

In the above output all the elements and attributes are coming under "order" object as I have specified target as "order".
Is there any way to take all the elements and attributes out of "order" without using xpath. With xpath I could able to achieve this by parsing every element and attributes with its path. But my xml is huge and I would like to avoid using xpath.

Basically I would like to have the output like below:

Expected Output:
"hits": [
{
"_index": "order",
"_type": "order",
"_id": "123",
"_score": 1,
"_source": {
"BillToID": "123",
"PersonInfo": {
"ShipNode": "53"
}
"OrderLines": {
"OrderLine" : [
{
"DeliveryMethod": "xyz"
}
]
}
]

Any help would be much appreciated.Preformatted text

2

Take a look at this.

3

Thanks Badger. Your solution worked.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.