Logstash error: parsing xml file

I am new on ELK and I need your help.
I would like to get some information about the cpu, memory. Those informative are generated every 30 minutes.

My xml file
<?xml version="1.0" encoding="UTF-8"?><measData><measInfo Id="SensorProcessingCounters"><measType p="1">SensorsProcessed</measType><measValue xxxxxxxxx ><r p="1">81</r></measValue></measInfo></measData>

My logstash file.conf
input {
file {
path => "/home/test/Desktop/data/file.xml"
start_position => beginning
sincedb_path => "/dev/null"
codec => multiline
pattern => "|"
negate => true
what => "previous"
xml {
store_xml => false
source => "message"
xpath =>
["//measInfo[@measInfoId="SensorProcessingCounters"]/measValue/r[@p='1']/text()", "SensorProcessingCounters"
convert => {
"SensorProcessingCounters"=> "float"}
action => "index"
hosts => ["localhost:9200"]
index => "stock"

error message
[2018-07-12T11:16:19,253][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-07-12T11:16:19,973][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.3.1"}
[2018-07-12T11:16:20,649][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, ,, ] at line 20, column 27 (byte 432) after filter\r\n{\r\nxml {\r\nstore_xml => false\r\nsource => "message"\r\nxpath =>\r\n["//measInfo[@measInfoId="", :backtrace=>["/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:42:in compile_imperative'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:50:incompile_graph'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:12:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:11:in compile_sources'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline.rb:49:ininitialize'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline.rb:167:in initialize'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline_action/create.rb:40:inexecute'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]}
[2018-07-12T11:16:21,024][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}

Thank you

Please look at the preview pane on the right when posting. Your xml is not visible. If you select it using the mouse and then click on </> in the toolbar above the composition window then that should fix that.

xpath => ["//measInfo[@measInfoId="SensorProcessingCounters"]/measValue/r[@p='1']/text()", "SensorProcessingCounters"]

If you have both single and double quotes then you will need to escape some of them.

Oh thank you.
Can someone help me to get the measVlue for each measType. Thank

    xml {
        xpath => ["//measInfo[@Id='SensorProcessingCounters']/measValue/r[@p='1']/text()", "SensorProcessingCounters" ]
        source => "message"
        store_xml => false
    if [SensorProcessingCounters] { mutate { replace => { "SensorProcessingCounters" => "%{[SensorProcessingCounters][0]}" } } }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.