Logstash regex expression in conf xpath

Elastic Stack Logstash
1

Dears,

Can we use regex expression in logstash configuration in case of filter and xpath?

There is right now such to conditions:

...
filter {
  if "xmlapps" in [tags] {
  xml {
    source => "message"
    store_xml => false
    force_array => false
    xpath => [
      "/log//re/im/field[@id='0']/@value", "app.rec",
      "/log//se/im/field[@id='0']/@value", "app.rec"
    ]
  }
  }
...

Is there any way to use regex expression in one line instead of two separate lines?
If yes please advise me how to do it. Thanks a lot.

Best Regards,
Dan

2

xpath does not directly support regexes, so you cannot do something compact like "/log//(re|se)/...".

You may be able to do something using Xpath functions, but creating an expression using something like starts_with or starts_with is probably not going to help anyone.

3

thanks a lot for your answer

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.