Issue parsing XML File with logstash

Hi to all

I have an XML file, and I'm parsing it with Logstash This is my filter section:

xml {
    source => message
    target => GLTData
    store_xml => true

However, my xml file has only 2 fields: "Date", and "Message", and after the parser works, leave 2 variables.

The field "Message" is complex, and I like the parser split this field as well.

XML Example (before parser works)

<LOGELEMENT><DATE>Apr 20, 2018 12:33:39 PM</DATE><MESSAGE><?xml version="1.0" encoding="ISO-8859-1"?><GLTData><BankId><![CDATA[9999]]></BankId><AppId><![CDATA[XYZ]]></AppId></GLTData></MESSAGE></LOGELEMENT>

Fields create after parser works

 GLTData.DATE           Apr 20, 2018 12:33:39 PM
    GLTData.MESSAGE          {
      "GLTData": [
          "BankID": [
          "AppID": [

I want the field inside MESSAGE can identify as a variables, I mean:


Some ideas about what modifications are neccesary? The XML structure is dynamic, I think XPath doesn't work

Thanks in advance

Dario R

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.