How to use ruby code to index some variable element from XML node

Hi expert,

I have used the logstash to parse some information with XML format, such like this:

<?xml version="1.0" encoding="UTF-8"?>
<OMeS version="2.3">
  <PMSetup startTime="2018-03-09T07:50:00.000+01:00" interval="5">
    <PMMOResult>
      <MO dimension="network_element">
        <DN>NTAS-tas01/HOSTNAME-cbam-4c63de7aeae2460289cd4197dc7-admintd-node-0/DBTYPE-cmdb</DN>
      </MO>
      <PMTarget measurementType="DBMEAS">
        <M704B1C1>32</M704B1C1>
        <M704B1C2>216</M704B1C2>
        <M704B1C3>0</M704B1C3>
        <M704B1C4>0</M704B1C4>
      </PMTarget>
    </PMMOResult>
 <PMMOResult>
      ... ...
 </PMMOResult>
     ... ... 

I have used xml plugin to parsed them.

xml {
                        source => "message"
                        target => "parsed"
}

Then the parsed result such like this:

parsed.PMSetup   
 {
      "startTime": "2018-03-09T07:50:00.000+01:00",
      "interval": "5",
      "PMMOResult": [
        {
          "MO": [
            {
              "DN": [
                "NTAS-tas01/HOSTNAME-cbam-4c63de7aeae2460289cd4197dc7-admintd-node-0/DBTYPE-cmdb"
              ],
              "dimension": "network_element"
            }
          ],
          "PMTarget": [
            {
              "measurementType": "DBMEAS",
              "M704B1C3": [
                "0"
              ],
              "M704B1C2": [
                "216"
              ],
              "M704B1C4": [
                "0"
              ],
              "M704B1C1": [
                "32"
              ]
            }
          ]
        },

Now my major work is want to add some indexes to use retrieve the xml data. such like this:

How can I use ruby to add these indexes to these points(which includes node name, node attribute and node text)?

I have tried to write some ruby codes such like this: but it doesn't work.

ruby { code => "
		rec = []

		pmMeasInfo = event['parsed']['PMSetup'][0]['PMMOResult']
		node = pmMeasInfo['MO']['DN'][0]
		pmType = pmMeasInfo['PMTarget'].attributes["measurementType"]

		pmMeasInfo.each do |m1|
			ValueType = m1.name
			pmValue = m1['PMtarget']

Would you please help us check it? thank you.

@magnusbaeck
expert, would you please help me check this question? thank you.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.