Parse XML Using Logstash


I have a XML in below format:

<OrderEvent actionCode = "5">

Filebeat picks up this xml and sends to logstash.

In logstash, I have below code for XML filter plugin.

xml {
source => "message"
store_xml => true
namespaces => {
"xsl" => ""
"xhtml" => ""

When I view the results on Kibana, I am not getting the results properly. Although it is picking up the XML. But the values which I require are different.

Values displayed on Kibana are:

  •  <OrderEvent actionCode = "5">
  •   <OrderNumber>ORD12345</OrderNumber>
  •  <VendorNumber>V11111</VendorNumber>

But values which I want to get is:

Field Name: actionCode and value = 5
Field Name: OrderNumber and value = ORD12345
Field Name: VendorNumber and value = V11111

Can anyone please help.


On the Filebeat side you need to use a multiline configuration to join all lines of the file into a single event. Examples of how this can be done has been posted in the past.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.