Logstash xml split filter

Hi team,

using the below logstash confg file xml filter

filter {
xml {
source => "message"
target => "xml_content"
split {
field => "xml_content[station]"
split {
field => "xml_content[station][name]"
mutate {
add_field => { "lastupdate" => "%{xml_content[lastupdate]}" }
add_field => { "name" => "%{xml_content[station][name][name]}" }
remove_field => ['xml_content', 'message', 'path']

getting invalid results check in kibana results

tags:multiline, _xmlparsefailure, _split_type_failure @timestamp:July 23rd 2018, 16:42:16.662 name:%{xml_content[station][name][name]} @version:1 lastupdate:%{xml_content[lastupdate]} _id:GmfXxmQBPb0XzgMOBBMj _type:doc _index:xmltest _score: -

can anyone help me on this thanks in advance

Thread moved to #logstash

Hi Dadoonet
can you please explain me in detail.

It is failing to parse the message as xml. What does the message look like? Comment out the remove_field until you are sure things are working correctly.

Hi Badger,
if i uncommented remove_field it is passing all the xml file as in message, i need to display/split only those filtered values in kibana


Once again, what does the message look like? Either paste from the JSON tab in Kibana/Discover or add stdout { codec => rubydebug } }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.