Logstash XML parsing issues - trying to send to Graylog, part 2

Elastic Stack Logstash
4

Not quite

ruby {
    code => '
      event.get("[xml_content][EventData][Data]").each { |a|
        name = a["Name"]
        value = a["content"]
        #event.set( "[someField][#{name}]", value)
        event.set( "[eventData.#{name}]", value)
      }
    '
}

You have the option whether to put the fields inside [someField] or to prefix the names with eventData. which your original config did.

2 Likes