Is it possible to change output structure

Elastic Stack Logstash
21

I didn't expect this will work, but it does.
I search smth what works when I don't know how many bid elements I have in my logfile.

22

Yup, probably your xml file is not in unique format.
The format is different with the bid elements, then we need to change the code,

if your xml file is in unique format there will not be any problem.

23

Ah no, it's not unique. I try to build a script which will work above XML files which can be different a bit different to each other. But the differences aren't that big. At the moment I try to learn ruby a bit so I work with one file and try to applay it to others.

24

My xml files looks like my sample but with multiple elements. The values can be different in every field.

<?xml version="1.0" ?>
<system>
<Report name="Scan">
<ReportHost ip="11.111.11.1"><HostProperties>
<tag pluginname="LastUnauthenticatedResults">1539<tag>
<tag pluginnname="Scan">false</tag>
</HostProperties>
<ReportItem port="0" severity="0">
</ReportItem>
<ReportItem port="22" severity="3">
</ReportItem>
<ReportItem port="80" severity="5">
</ReportItem>
</ReportHost>
<ReportHost ip="128.98.11.9"><HostProperties>
<tag pluginname="os">linux<tag>
<tag pluginname="cpe">linux_kernel</tag>
</HostProperties>
<ReportItem port="17" severity="3">
</ReportItem>
<ReportItem port="22" severity="3">
<bid>1111</bid>
<bid>2222</bid>
</ReportItem>
<ReportItem port="80" severity="7">
<bid>1787</bid>
<cve>CVE-2008-5161</cve>
<cve>CVE-2007-6713</cve>
<solution>n/a</solution>
</ReportItem>
</ReportHost>
</Report>
</system>

And my files have about 300000 lines where they should work...

25

it sounds like a good idea, try it.

26

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.