Logstash xml filter

Elastic Stack Logstash
1

I want to store the following xml format data at once.

<title>name</title>
<destination>my name</destination>
<log>hi~ my name is taewoo!</log>
<date>2018-09-04T09:00:00</date>

However, each field is stored separately, creating three documents.

Below is the configuration file.
How can I fix all the fields in one document?

input {
    file {
        path => "/usr/local/ELK/logstash-6.3.2/config/test1.xml"
        start_position => "beginning"
        type => "xml"
    }
}

filter {
    xml {
        remove_namespaces => true
        source => "message"
        xpath => ["/title", "title",
                  "/destination", "destination",
                  "/log", "log",
                  "/date", "date"]
        target => "doc"
        store_xml => true
    }
}
output {
    elasticsearch {
        hosts => ["127.0.0.1:9200"]
        index => "t4"
#        document_type => "test"
        user => "elastic"
        password => "root123"

    }
    stdout {}
}
2

The file input reads files line by line. If you want to join multiple lines into a single event you should use a multiline codec.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.