@badger,
Okay so i tried splitting the rows,
Here's the json on Es on where the status is down:
{
* "_index": "appdappstatus",
* "_type": "_doc",
* "_id": "worktext",
* "_score": 1,
* "_source": {
* "@timestamp": "2020-07-10T10:54:00.528Z",
* "@version": "1",
* "http_poller_metadata": {
* "host": "strp2.com",
* "response_headers": {
* "date": "Fri, 10 Jul 2020 10:54:00 GMT"},
* "name": "worktext",
* "request": {
* "method": "get"}},
* "Status": "DOWN",
* "tags": [
* "_split_type_failure"],
* "URL": ["https://worktext.com"](https://worktext.com/),
* "xmldata": {
* "metric-data": {
* "metricName": "Server|Component:54|Custom Metrics|URL Monitor|worktext.com|Response Code",
* "metricId": "606843",
* "metricPath": "Application Infrastructure Performance|URL-Tier|Individual Nodes|URL-Tier_str07|Custom Metrics|URL Monitor|worktext.com|Response Code",
* "frequency": "ONE_MIN",
* "metricValues": {
* "metric-value": {
* "occurrences": "1",
* "current": "200",
* "min": "200",
* "max": "200",
* "useRange": "true",
* "startTimeInMillis": "1594378320000",
* "count": "1",
* "sum": "200",
* "value": "200",
* "standardDeviation": "0"}}},
* "metric-datas": {
* "metric-data": {
* "metricName": "METRIC DATA NOT FOUND",
* "metricId": "733477",
* "metricPath": "Application Infrastructure Performance|URL-Tier|Individual Nodes|URL-Tier_strp07|Custom Metrics|URL Monitor|Response Code",
* "frequency": "ONE_MIN"}},
* "occurrences": "1",
* "current": "200",
* "min": "200",
* "max": "200",
* "startTimeInMillis": "1594374300000",
* "useRange": "true",
* "count": "1",
* "sum": "200",
* "value": "200",
* "standardDeviation": "0"}}
}
And Heres the one with UP status, done right:
{
* "_index": "appdappstatus",
* "_type": "_doc",
* "_id": "ras080",
* "_score": 1,
* "_source": {
* "@timestamp": "2020-07-10T10:48:00.553Z",
* "@version": "1",
* "http_poller_metadata": {
* "host": "strom",
* "response_headers": {
* "date": "Fri, 10 Jul 2020 10:48:00 GMT"},
* "name": "ras080",
* "request": {
* "method": "get"}},
* "Status": "UP",
* "tags": [
* "multiline"
, * "_split_type_failure"],
* "xmldata": {
* "metric-data": {
* "metricName": "Server|Component:54|Custom Metrics|URL Monitor|rascom-8080|Response Code",
* "metricPath": "Application Infrastructure Performance|URL-Tier|Individual Nodes|URL-Tier_spd07|Custom Metrics|URL Monitor|ras080|Response Code",
* "metricId": "829383",
* "frequency": "ONE_MIN",
* "metricValues": {
* "metric-value": {
* "occurrences": "1",
* "useRange": "true",
* "startTimeInMillis": "1594377960000",
* "max": "200",
* "min": "200",
* "count": "1",
* "value": "200",
* "current": "200",
* "sum": "200",
* "standardDeviation": "0"},
* "occurrences": "1",
* "min": [
* "200"
, * "200"],
* "max": "200",
* "startTimeInMillis": "1594370160000",
* "useRange": "true",
* "value": [
* "200"
, * "200"]},
* "sum": "200",
* "value": "200",
* "standardDeviation": "0"},
* "count": "1",
* "standardDeviation": "0"},
* "URL": ["http://1080/"](http://10.080/)}
}
I dont know if there are any valid differences to be considered,
filter
{
xml {
source => "message"
store_xml => "true"
target => "xmldata"
force_array => false
}
split
{
field => ["metric-value"]
}
split
{
field => ["[xmldata][metric-data][metricValues][metric-value]"]
}
if [xmldata][metric-data][metricValues][metric-value][value] == "200"
{
mutate { add_field => { "Status" => "UP"} }
}
else
{
mutate { add_field => { "Status" => "DOWN"} }
}
}
@Badger, Do you see a potential cause in these?