Ingesting XML data from UDP input plugin thru elasticsearch output plugin

Elastic Stack Logstash
1

Hello everyone, I need to ingest an XML received over UDP input plugin. The output plugin needs to be "elasticsearch". This is an example of XML:

<EVENT>
	<HOST>FRANCESCOE-RMT</HOST>
	<INSTANCEID>3C38C41D-9F66-47AB-AF8D-582A4BBEDD0D</INSTANCEID>
	<APPLICATION>TESTUDPLOGGER</APPLICATION>
	<THREADID>20172</THREADID>
	<APPVERSION>1.0.1.11</APPVERSION>
	<LINENO>1</LINENO>
	<EVENTSEQNO>1</EVENTSEQNO>
	<EVENTDATETIME>04/14/2025 14:11:24:977</EVENTDATETIME>
	<SEVERITY>0</SEVERITY>
	<EVENTNAME>TestEvent1 04/14/2025 14:11:24:11</EVENTNAME>
	<EVENTINFO>04/14/2025 14:11:24:11benfranksue</EVENTINFO>
</EVENT>

So, my approach is to try to translate this XML in a JSON. All the fields inside need to become json fields.

I am starting try to save the data received to a file, thinking that when I will be able to have a json compatible with my index, elasticsearch output plugin will be able to process it.

How would you guys configure that? Am I on the right track?

input {
	udp {
		port => 517
	}
}
filter {
??????
}
output {
	file {
		path => "/log_streaming/my_app/records/log-%{+yyyy-MM-dd_HH.mm.ss.SSS}.log"	
		codec => line { format => "%{message}" }
	}
}
2

I think I made it with this:

input {
	udp {
		port => 517
	}
}
filter {
	xml {
		force_array => false
		source => "message"
		target => "myxml"
	}
}
output {
	file {
		path => "/log_streaming/my_app/records/log-%{+yyyy-MM-dd_HH.mm.ss.SSS}.log"	
		codec => line { format => "%{myxml}" }
	}
}
1 Like