input { beats { port => 5044 } }
filter {
kv {field_split => "message"
}
kv {
source => "n id"
field_split => ","
}}
output { elasticsearch { hosts => ["http://localhost:9200 "] index => "atpidev1" } }
11:44
is it correct config to split each n id to different row
getting result like above image
it should show as like showing in below image
Able to achieve requirement with following conf
input { beats { port => 5044 } }
filter {
mutate {
split => { "message" => "@$@" }}
mutate {
add_field => { "response" => "%{[message][1]}" "request" => "%{[message][0]}" } }
xml { store_xml => "false" source => "response" target => "xmldata"
xpath =>[
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/@id ","ratePlanid",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/roomDetails/roomTypeCode/text()","roomTypeCode",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/roomDetails/hhRoomType/text()","hhRoomType",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/roomDetails/hhBedTypes/hhBedType/text()","hhBedTypes",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/rateDetails/rateTypeCode/text()","rateTypeCode",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/rateDetails/breakfastIncluded/text()","breakfastincluded",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/rateDetails/nonRefundable/text()","nonRefundable",
"/propertyAvailability/hotelRates/hotel/bookingChannel/ratePlan[1]/roomRateDetails/roomRateCode/text()","roomRateCode",
"/propertyAvailability/hotelRates/hotel/bookingChannel/@type ","bookingChannel" ]
}
split {field => "bookingChannel"}
split {field => "ratePlanid"}
split {field => "roomTypeCode"}
split {field => "hhRoomType"}
split {field => "hhBedTypes"}
split {field => "rateTypeCode"}
split {field => "breakfastincluded"}
split {field => "nonRefundable"}
split {field => "roomRateCode"}
}
output { elasticsearch { hosts => ["http://localhost:9200 "] index => "atpidev07jul2020-432" } }
system
(system)
Closed
August 31, 2020, 11:08am
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.