Hi all,
I have a xml-File with windows eventlogs that is structured like this:
<Events>
<Event>
<Computer>...</Computer>
...
<EventData>
<Data Name = "ErrorCode"> 0 </Data>
<Data Name = "ipaddress"> 127.0.0.1 </Data>
<Data Name = "port">800</Data>
...
</EventData>
</Event>
<Event>
...
</Event>
<Events>
The problem is I am not able to extract sub fields of EventData and add those fields in the index.
For Example: I need to extract sub field "ErrorCode" from EventData and add a separate field "error" in the index with value of ErrorCode, i.e, 0.
At first I added this line in my xml filter
filter {
xml{
source => "message"
store_xml => false
target => "Event"
xpath => ["/Event/EventData/Data[@Name='ipaddress']", "sourceIP"]
}
}
But the field wasn't created.
So I tried using split filter
filter {
xml{
source => "message"
store_xml => false
target => "parsed"
}
split{
field => "[parsed][Event]"
add_field => {
sourceIP => "%{[parsed][Event][EventData][Data][@Name='ipaddress']}"
}
}
mutate {
remove_field => ["message", "host"]
}
}
Even this didn't work. I searched on the internet but only got a solution for using ruby, but there i can't rename my field :
Xml filtering subfields - #23
ruby {
code => '
e = event.get("[@metadata][theXML][Event][EventData][Data]")
if e
e.each { |x|
event.set(x["Name"], x["content"])
}
end
'
}
Is there any other way to extract subfields, or am I doing something wrong in my conf file here sourceIP => "%{[parsed][Event][EventData][Data][@Name='ipaddress']}"