Logstash import XML/ HTTP fails

Elastic Stack Logstash
1

I am new in this field. I have the following XML file, I want to separate the fields eg "so2Grade", "coFlag",... into rows one by one.

ex
ex944×896 39 KB

My conf file is as follows:

 input {
http_poller {
 urls => {
        urlname => "http://apis.data.go.kr/B552584/ArpltnInforInqireSvc/getCtprvnRltmMesureDnsty?sidoName=%EC%84%9C%EC%9A%B8&pageNo=1&numOfRows=100&returnType=xml&serviceKey=Yc96GsDLH5upnc%2FJwYTOM61ZBRbh%2FGuHfW2Yzqw1kNB77j93jqrS%2Fzox3vUCka2%2BLuy0pRoNbInfVp%2BNOr5Pjw%3D%3D&ver=1.0"
        }
        request_timeout => 60
        schedule =>  {every => "20s"}
        codec => multiline {
	pattern => “<item>|</item>”
	negate => “true”
	what => “previous”
}
}
filter {
xml {
        source => "message"
        remove_namespaces => "true"
        target => "pared"
        store_xml => "false"
	xpath => [
		"/body/items/item/@so2Grade","so2Grade",
		"/body/items/item/@coFlag","coFlag",
		"/body/items/item/@khaiValue","khaiValue",
		"/body/items/item/@so2Value","so2Value",
		"/body/items/item/@coValue","coValue",
		"/body/items/item/@pm25Flag","pm25Flag",
		"/body/items/item/@pm10Flag","pm10Flag",
		"/body/items/item/@o3Grade","o3Grade",
		"/body/items/item/@pm10Value","pm10Value",
		"/body/items/item/@khaiGrade","khaiGrade",
		"/body/items/item/@pm25Value","pm25Value",
		"/body/items/item/@psidoName","sidoName",
		"/body/items/item/@no2Flag","no2Flag",
		"/body/items/item/@no2Grade","no2Grade",
		"/body/items/item/@o3Flag","o3Flag",
		"/body/items/item/@pm25Grade","pm25Grade",
		"/body/items/item/@so2Flag","so2Flag",
		"/body/items/item/@dataTime","dataTime",
		"/body/items/item/@coGrade","coGrade",
		"/body/items/item/@no2Value","no2Value",
		"/body/items/item/@stationName","stationName",
		"/body/items/item/@pm10Grade","pm10Grade",
		"/body/items/item/@o3Value","o3Value",

}

mutate {
        remove_field => ["@version","beat","count","fields","input_type","offset","source","type","host","tags","path","response","message"]
}
}
output {
  elasticsearch {
    hosts => ["http://20.249.85.198:9200"]
    index => "air-seoul"
    document_type => "airseoul"
    
  }
stdout { codec => rubydebug }

}

Please help me. Thank you so much

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.