Logstash regex expression in conf xpath

[d.silwon (Daniel)]

Dears,

Can we use regex expression in logstash configuration in case of filter and xpath?

There is right now such to conditions:

...
filter {
  if "xmlapps" in [tags] {
  xml {
    source => "message"
    store_xml => false
    force_array => false
    xpath => [
      "/log//re/im/field[@id='0']/@value", "app.rec",
      "/log//se/im/field[@id='0']/@value", "app.rec"
    ]
  }
  }
...

Is there any way to use regex expression in one line instead of two separate lines?
If yes please advise me how to do it. Thanks a lot.

Best Regards,
Dan

[Badger]

xpath does not directly support regexes, so you cannot do something compact like "/log//(re|se)/...".

You may be able to do something using Xpath functions, but creating an expression using something like starts_with or starts_with is probably not going to help anyone.

[d.silwon (Daniel)]

thanks a lot for your answer