Issue parsing XML File with logstash

Elastic Stack Logstash
1

Hi to all

I have an XML file, and I'm parsing it with Logstash This is my filter section:

xml {
    source => message
    target => GLTData
    store_xml => true
  }

However, my xml file has only 2 fields: "Date", and "Message", and after the parser works, leave 2 variables.

The field "Message" is complex, and I like the parser split this field as well.

XML Example (before parser works)

<LOGELEMENT><DATE>Apr 20, 2018 12:33:39 PM</DATE><MESSAGE><?xml version="1.0" encoding="ISO-8859-1"?><GLTData><BankId><![CDATA[9999]]></BankId><AppId><![CDATA[XYZ]]></AppId></GLTData></MESSAGE></LOGELEMENT>

Fields create after parser works

 GLTData.DATE           Apr 20, 2018 12:33:39 PM
    GLTData.MESSAGE          {
      "GLTData": [
        {
          "BankID": [
            "9999"
          ],
          "AppID": [
            "XYZ"
          ],
       ]
       }

I want the field inside MESSAGE can identify as a variables, I mean:

GLTData.DATE
GLTData.MESSAGE.BankID          
GLTData.MESSAGE.AppID
.....

Some ideas about what modifications are neccesary? The XML structure is dynamic, I think XPath doesn't work

Thanks in advance

Dario R

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.