IF condition with XML filter

Elastic Stack Logstash
1

hi all,

I'm trying to apply an XML filter based on the value of one of the fields. So, the config for that part looks like this:

      filter{
                if [my_field] == "x.zhh"{
                xml{
                store_xml => "false"
                source => "[myxml][payload][xml]"

                xpath => ["/testData/name/@type","Type"]

                remove_namespaces => "true"
                }
                }
        mutate{
                add_field => {"test_IF" => "TEST"}
                }
}

Somehow, the XML filter is ignored and I see only the output of mutate function. I checked and the field my_field has value.

Not sure what exactly is wrong with the config. Can anyone help with this?

Thanks

2

Please show an example event. Use a stdout { codec => rubydebug } output.

3

ok, so, xml content looks like the following:

<Xmlns:testData http://example.com test:myField="x.zhh">
<test:name type="55">
<test:text test:content="222"/>
</test:data1>
<test:year test:content="1999"/>
</test:year>
</testData>

applying the xml filer without any IF condition works fine, but whenever I add the condition it just ignores the xml filter.

4

I'd like to see the output from stdout { codec => rubydebug }.

5

it's solved now. i didn't comment out the part of removing some fields. :slight_smile: sorry.

Thanks for the help though!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.