Logstash 6.1: XML parsing doesn't work

Elastic Stack Logstash
1

I am extracting array tags from xml . the defined xpath doesn't capture.

Config file:
input {
stdin {
type => "02Jan2018122417_180102_3R_3dd37a7cf4a843a6dc90e56822b31fe6_Swissotel-Desktop_WebpageSummary.xml"
codec => multiline {
pattern => "|"
negate => true
what => "previous"
max_lines => "5000"
max_bytes => "100 MB"
}
}
}

filter {
   if [message] =~ "^<\?xml .*" {
    drop {}
  }
  
  xml {
       source => "message"
       target => "xml_content"
       force_content => "true"
	store_xml => false
	xpath => ["/response/data/run/firstView/videoFrames/frame[*]/time/text()","Time_FV"]
	xpath => ["/response/data/run/firstView/videoFrames/frame[*]/image/text()","Image_FV"]
	xpath => ["/response/data/run/firstView/videoFrames/frame[*]/VisuallyComplete/text()","Progress_FV"]
	}
}

output { 
	   stdout { codec => rubydebug }
}

Any idea whats wrong here?

2

How do you expect us to answer without knowing what the XML document looks like? Show us the output of stdout { codec => rubydebug }.

3

Thanks Magnus for your interest and sorry for half of the information passed. However found the root cause in the source XML file only. Tag was broken due to which logstash was unable to read the xpath. after rectifying the tags it works.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.