Logstash error: parsing xml file

[saisimo02 (Mohamed)]

Hello,
I am new on ELK and I need your help.
I would like to get some information about the cpu, memory. Those informative are generated every 30 minutes.

My xml file
<?xml version="1.0" encoding="UTF-8"?><measData><measInfo Id="SensorProcessingCounters"><measType p="1">SensorsProcessed</measType><measValue xxxxxxxxx ><r p="1">81</r></measValue></measInfo></measData>

My logstash file.conf
input {
file {
path => "/home/test/Desktop/data/file.xml"
start_position => beginning
sincedb_path => "/dev/null"
codec => multiline
{
pattern => "|"
negate => true
what => "previous"
}
}
}
filter
{
xml {
store_xml => false
source => "message"
xpath =>
["//measInfo[@measInfoId="SensorProcessingCounters"]/measValue/r[@p='1']/text()", "SensorProcessingCounters"
]
}
mutate{
convert => {
"SensorProcessingCounters"=> "float"}
}
}
output{
elasticsearch
{
action => "index"
hosts => ["localhost:9200"]
index => "stock"
}
stdout{}
}

---

error message
[2018-07-12T11:16:19,253][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-07-12T11:16:19,973][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.3.1"}
[2018-07-12T11:16:20,649][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, ,, ] at line 20, column 27 (byte 432) after filter\r\n{\r\nxml {\r\nstore_xml => false\r\nsource => "message"\r\nxpath =>\r\n["//measInfo[@measInfoId="", :backtrace=>["/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:42:in compile_imperative'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:50:incompile_graph'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:12:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:11:in compile_sources'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline.rb:49:ininitialize'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline.rb:167:in initialize'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline_action/create.rb:40:inexecute'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]}
[2018-07-12T11:16:21,024][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}

Thank you

[Badger]

Please look at the preview pane on the right when posting. Your xml is not visible. If you select it using the mouse and then click on </> in the toolbar above the composition window then that should fix that.

xpath => ["//measInfo[@measInfoId="SensorProcessingCounters"]/measValue/r[@p='1']/text()", "SensorProcessingCounters"]

If you have both single and double quotes then you will need to escape some of them.

[saisimo02 (Mohamed)]

Oh thank you.
Can someone help me to get the measVlue for each measType. Thank

[Badger]

    xml {
        xpath => ["//measInfo[@Id='SensorProcessingCounters']/measValue/r[@p='1']/text()", "SensorProcessingCounters" ]
        source => "message"
        store_xml => false
    }
    if [SensorProcessingCounters] { mutate { replace => { "SensorProcessingCounters" => "%{[SensorProcessingCounters][0]}" } } }