I have an xml which I have an attached
I am parsing this xml using xml filters in logstash.
I have a field t ="296" in my xml. This represents response time.
And logstash is parsing each field as an array like
"response_time" => [
[0] "296"
[1] "296"
]
I want it to be a single value instead of an array. "response_time" => 296
I have attached both my input xml file ,my logstash configuration and my logstash ouput.
Kindly help me.
Please don't post screenshots. They're hard to read and can't be copied/pasted from.
Your mutate filter with add_field is useless, remove it.
Sure sorry for the screenshots. I was not able to copy/paste here because I'm working inside a Oracle Client connection.
I removed mutate filter add_field.
I am getting "response_time" =>[
[0] "296"
]
in my response.
It is still an array.
If I don't use add_field I'm not getting the values.
I am getting "response_time" => "%{response_time}"
Then the response_time field didn't exist at that time. It's hard to help since a) you're deleting the message field that contains useful information about exactly what the input looks like and b) screenshots can't be copied from.
Please could check my edited response.
I removed mutate filter add_field.
I am getting "response_time" =>[
[0] "296"
]
in my response.
Recent versions of the xml filter have a force_array option that you can disable to not create array fields unless actually needed.
xml {
force_array => "false"
}
Still not working. Is it the right way to disable it?
I wouldn't use the double quotes but it should work anyway. What version of the xml filter is this?
I just updated to 2.3.0.
Still I'm facing the same issue.