If else on xpath value in Logstash


(Karan Shah) #1

Hi,

I am trying to create two new fields based on the value of xpath. For example if the station_name is "Finch" then create a field name "ny_station" else store the value in "nonny_stations". Can anyone help me that below is the codified version of what I am trying to achieve.

if "Finch" in [station_name] {
xpath => ["/station/name/text()","Ny_station"]
}
else {
xpath => ["/station/name/text()","nonNy_station"]
}

Here is the structure of my xml file

Here is my config file
input
{
file
{
path => "C:\Users\186181152\Downloads\stations3.xml"
start_position => "beginning"
sincedb_path => "/dev/null"
exclude => "*.gz"
type => "xml"
codec => multiline {
pattern => ""
negate => "true"
what => "previous"
}
}
}
filter
{
xml
{
source => "message"
store_xml => false
target => "stations"
xpath => [
"/stations/station/id/text()", "station_id",
"/stations/station/name/text()", "station_name"
]
}

}

output
{
elasticsearch
{
codec => json
hosts => "localhost"
index => "xmlns24"
}
stdout
{
codec => rubydebug
}
}


(Karan Shah) #2

HI, This is the working solution to what I want to achieve

Following is the
if "Finch" in [station_name]
{ mutate
{ add_field => {"Ny_station" => "%{station_name}"}
}
}
else
{ mutate
{ add_field => {"nonNy_station" => "%{station_name}"}
}
}


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.