Issues parsing xml data

Elastic Stack Logstash
1

I've setup a filter to try to split an XML and assign the fields to fields I can use but the split isn't working.

I'm using http_poller to pull the following xml file over

<?xml version="1.0" encoding="UTF-8"?><df:Feed xmlns:df="http://www.domain.com/xsd/services/feed" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Concept="EX">
<df:Sku>
<df:Number>503616</df:Number>
<df:Name>Product 1 Name</df:Name>
<df:ImageUrl>https://www.domain.com/imgs/rk/images/dp/201724/0002/img31</df:ImageUrl>
</df:Sku>
<df:Sku>
<df:Number>244324</df:Number>
<df:Name>Product 2 Name</df:Name>
<df:ImageUrl>https://www.domain.com/imgs/rk/images/dp/201718/0013/img25</df:ImageUrl>
</df:Sku>
</df:Feed>

Here is the error that I'm receiving

#<REXML::UndefinedNamespaceException: Undefined prefix df found>

Here is the input/filter of my config

input {
  http_poller {
    urls => {
        url => "http://192.168.74.179:49180/data/14/P/66/10035/IVR.xml"
    }

    request_timeout => 10
    interval => 10

    codec => multiline {
      pattern => "^\<df\:Sku\>"
      negate => "true"
      what => "previous"
    }
  }
}

filter {
if [log_type] == "xmllog" {

xml {
    source => "message"
    target => "parsed"
    remove_namespaces => true
    store_xml => true
    force_array => true
    xpath => [
        "/Sku/Number/text()","number",
        "/Sku/Name/text()","name",
        "/Sku/ImageUrl/text()","url"
    ]
}

I've tried escaping the df: fields

field => "[parsed][df\:Sku]"

I'm able to separate the fields how I would like, however each filter request is throwing the undefined prefix error in the logs, throwing an xmlparsefailure.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.