How to use grok filter on XML field

Elastic Stack Logstash
1

Hi,
I have a csv files .
One of the fields has an xml strutcher.
I need to return the value that exists between the first apperence of :
In this case i need to return : 0-GOLD

<SVC ID="0" SUCC="1"><PLCY><PLAN>0-GOLD</PLAN><PLAN>0-GOLD</PLAN><PLAN>NEW_SPECIAL</PLAN><PLAN>MIN-MAX FILTER</PLAN><PLAN>CARRIER CHECK IN</PLAN><PLAN>0-GOLD SPLIT</PLAN></PLCY><Time>2018-10-22+05:31:14.270</Time></SVC>

Please advise how to do it .....

Thanks

2

Please edit your post, select the data, and click on </> in the toolbar above the edit pane, and make sure the data appears correct in the preview pane on the right.

If you have xml I would start with an xml filter.

3

Hi

Can please advise how ? Can you share an example ?

Thanks

4 
xml { source => "message" target => "theXML" }
mutate { copy => { "[theXML][PLCY][0][PLAN][0]" => "someField" } }
5

The latest example was releay helpful.
I was wonder if you can advise how to return only the first element in the Array.

The xml:
<SVC ID="0" SUCC="1"><PLCY><PLAN>0-GOLD</PLAN><PLAN>0-GOLD</PLAN><PLAN>NEW_SPECIAL</PLAN><PLAN>MIN-MAX FILTER</PLAN><PLAN>CARRIER CHECK IN</PLAN><PLAN>0-GOLD SPLIT</PLAN></PLCY><Time>2018-10-22+05:31:14.270</Time></SVC>

The program:

  xml { source => "message" target => "theXML" }
        mutate { copy => { "[theXML][PLCY][0][PLAN][0]" => "someField" } }

The result:

"theXML" => {
        "SUCC" => "1",
        "PLCY" => [
            [0] {
                "PLAN" => [
                    [0] "0-GOLD",
                    [1] "0-GOLD",
                    [2] "NEW_SPECIAL",
                    [3] "MIN-MAX FILTER"
                    .... 
                ]
            }
  1. I would like to assign into => "someField" , only the first element : 0-GOLD
  2. Can you advise on a link to documentation that explain how you build the statment above ?

Thanks alot for your help !

6

That is what the second line of my example does.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.