Parse XML Using Logstash

Elastic Stack Logstash
1

Hi

I have a XML in below format:

<OrderEvent actionCode = "5">
<OrderNumber>ORD12345</OrderNumber>
<VendorNumber>V11111</VendorNumber>
</OrderEvent>

Filebeat picks up this xml and sends to logstash.

In logstash, I have below code for XML filter plugin.

xml {
source => "message"
store_xml => true
namespaces => {
"xsl" => "http://www.w3.org/1999/XSL/Transform"
"xhtml" => "http://www.w3.org/1999/xhtml"
}
}

When I view the results on Kibana, I am not getting the results properly. Although it is picking up the XML. But the values which I require are different.

Values displayed on Kibana are:

  •  <OrderEvent actionCode = "5">

  •   <OrderNumber>ORD12345</OrderNumber>

  •  <VendorNumber>V11111</VendorNumber>

But values which I want to get is:

Field Name: actionCode and value = 5
Field Name: OrderNumber and value = ORD12345
Field Name: VendorNumber and value = V11111

Can anyone please help.

Thanks

2

On the Filebeat side you need to use a multiline configuration to join all lines of the file into a single event. Examples of how this can be done has been posted in the past.