I am trying to parse repeated tags in xml using split filter to get result as below example:
If my logstash is:
<?xml version="1.0" encoding="UTF-8"?>
<ROOT ID="01">
<EVENTLIST>
<EVENT name="abc"/>
<EVENT name="def"/>
</EVENTLIST>
</ROOT>
Then output should be:
[
ID => 01
name => abc
]
[
ID => 01
name => def
]
My logstash is:
filter {
if [fields][log_type] == "XMLs" {
xml {
source => "message"
target => "xml_content"
split {
field => "xml-content[Header][Record][Assortment]"
}
split {
field => "xml-content[Header][Record][Assortment][ID]"
}
split {
field => "xml-content[Header][Record][Assortment][ReceivingStore]"
}
split {
field => "xml-content[Header][Record][Assortment][ReceivingStore][StoreInternalID]"
}
mutate
{
add_field => { "Status" => "%{xml-content[Header][Record][Assortment][actionCode]}%{xml-content[Header][Record][Assortment][ReceivingStore][actionCode]}" }
add_field => { "Key" => "%{xml-content[Header][Record][Assortment][ID]}" }
add_field => { "Id" => "%{xml-content[Header][Record][Assortment][ReceivingStore][StoreInternalID]}" }
output {
stdout {
codec => rubydebug
}
}
Its showing the error:
what changes are required in split filter or any where else to get desirable output and what should be included in filebeat for this scenario.
I am a novice in ELK so requesting to make your reply as simple as possible.