# logstash xml filter

**URL:** https://discuss.elastic.co/t/logstash-xml-filter/147502
**Category:** 한국어 질문 및 토론
**Created:** [September 6, 2018, 6:28am UTC](https://discuss.elastic.co/t/logstash-xml-filter/147502 "2018-09-06T06:28:08Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![xodn0812](https://avatars.discourse-cdn.com/v4/letter/x/c5a1d2/32.png) [@xodn0812](https://discuss.elastic.co/u/xodn0812)
#### Post date: [September 6, 2018, 6:28am UTC](https://discuss.elastic.co/t/logstash-xml-filter/147502/1 "2018-09-06T06:28:08Z")

</div>

HTTP로 들어오는 xml 형식을 받고 싶은데 받기는 받아지는데 필드들이 자기자리를 찾아서 저장이 안되네요 ㅠㅠ  
conf 파일은 아래와 같습니다.  
input {  
file {  
path =\> "/usr/local/ELK/logstash-6.3.2/config/test1.xml"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
type =\> "xml"  
}  
stdin {  
# codec =\> xml  
}  
http {  
host =\> "127.0.0.1"  
port =\> "5001"  
}

```
}

filter {
    xml {
        remove_namespaces => true
        source => "message"
        xpath => ["/title/text()", "title","/destination/text()", "destination","/log/text()", "log","/date/text()", "date"]
        target => "doc"
        store_xml => true
    }
}
output {
    elasticsearch {
        hosts => ["127.0.0.1:9200"]
        index => "t5"
# document_type => "test"
        user => "elastic"
        password => "root123"

    }
    stdout {}
}

```

여기에 아래 curl을 던지면  
`curl -XPUT 'http://127.0.0.1:5001' -d '<?xml version="1.0" encoding="UTF-8" standalone="yes"?><title>name</title><destination>my name</destination><log>hi~ my name is taewoo!</log><date>2018-09-04T09:00:00</date>'`

아래와 같이 저장됩니다.

> {  
> "@timestamp" =\> 2018-09-06T05:01:53.292Z,  
> "tags" =\> [  
> [0] "\_xmlparsefailure"  
> ],  
> "@version" =\> "1",  
> "message" =\> "curl -XPUT '[http://127.0.0.1:5001](http://127.0.0.1:5001)' -d '\<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\>namemy namehi~ my name is taewoo!2018-09-04T09:00:00'",  
> "host" =\> "hostname"  
> }

아래와 같은 형태의 파일을 읽어도 첫번째 title부분만 저장됩니다.  
`<?xml version="1.0" encoding="UTF-8" standalone="yes"?><title>name</title><destination>my name</destination><log>hi~ my name is taewoo!</log><date>2018-09-04T09:00:00</date>`

결과:  
{  
"tags" =\> [  
[0] "\_xmlparsefailure"  
],  
"@version" =\> "1",  
"path" =\> "/usr/local/ELK/logstash-6.3.2/config/test1.xml",  
"@timestamp" =\> 2018-09-06T05:01:51.213Z,  
"title" =\> [  
[0] "name"  
],  
"message" =\> "\<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\>namemy namehi~ my name is taewoo!2018-09-04T09:00:00",  
"type" =\> "xml",  
"host" =\> "hostname"  
}

잘 저장시킬수 있는 방법 없을까요?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 4, 2018, 6:28am UTC](https://discuss.elastic.co/t/logstash-xml-filter/147502/2 "2018-10-04T06:28:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.