Parse XML out of message section in document

Elastic Stack Elasticsearch
1

Hi Everyone,
I have gone through alot of the XML parsing threads and none of them really match what I am wanting to do. So when I search and a document is returned, if there there is an XML associated to the document, we store the XML in the message section. Is there a way to just parse the XML out of the message section in a document? Thanks, we just started using Elastic and have not quite figured a way out to do this yet.

2

Hi,

Sure you can use logstash Xml filter plugin | Logstash Reference [8.2] | Elastic

You can check beforehand if your document contains xml by simple regex or specific rules based on your dataset.

3

OK, that might be my issue, I don't think we have the logstash package installed. I would see a logstash area under the dev tools correct?

4

Hi,

Well Logstash is supposed to be playing a role before the ingest of data by Elasticsearch, you can do multiple things.

You're ingesting data through an Elasticsearch input pipeline ?

I wasnt trying to confuse you logstash is a completly sperate component from Elasticsearch.

5

Thanks for the input, I was not included on how our orgs Elasticsearch is set up. I guess I need to do some more digging before I really try anything else. Thanks again.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.