Keep order of xml in Logstash

I am parsing XML-input in Logstash, and I need to keep the sorting of it, as it is relevant.
Example xml:

<log>
<trace id="77">
    <event id="Activity1" timestamp="2020-09-04T08:39:09.210"  />
    <advance delta="P1D" timestamp="2020-09-04T08:39:36.583" />
    <event id="Activity0" timestamp="2020-09-04T08:39:42.593" />
</trace>
</log>

I get the data via the http filter in the filter{} part of my script, but when I transform it to xml using

xml {
    source => "body"
    target => "dcrsims"
}

the sorting is forgotten, and everything is sorted into tags instead, so I have an "event" part and an "advance" part - the internal sorting is kept, but I can't know when an advance comes in between two events.

The xml transform is making my further code so much easier, so is there a way to keep the ordering of the elements?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.