Parsing failedRequest IIS

Hello,

Anyone can help me parsing element "Buffer" with failed Request of IIS? I identifed 2 elements with same name (Buffer).
If i'm run xpath (/failedRequest/tns:Event[26]/tns:EventData//tns:Data[@Name='Buffer']/text()) in http://www.xpathtester.com/xpath (remember put namespaces) work, but in Logstash not working.

Logstash config:
https://pastebin.com/hzbu2qNj

XML FailedRequest
https://pastebin.com/jCWhhcJt

Logstash Output
{
"RemoteAddress" => [
[0] "192.168.0.1"
],
"Htmlerror" => [
[0] "json=[]&vtesteariacao=Vini\n"
],
"offset" => 88796,
"Headers" => [
[0] "Connection: close\nContent-Length: 28\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nAccept: text/html, /; q=0.01\nAccept-Encoding: gzip, deflate, br\nAccept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3\nCookie: _ga=GA1.3.1515350952.1506608472; PathStorage=; ASP.NET_SessionId=rrdmtu3ftekpyon0gmgws1km; _ga=GA1.4.1515350952.1506608472; _gid=GA1.4.183052501.1508847309; __atuvc=1%7C43; __atuvs=59ef2f14b3f0b880000\nHost: http://localhost:80/ \nReferer: http://localhost:80/testapp4.0/default.aspx\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\nX-Requested-With: XMLHttpRequest\n"
],
"appPoolId" => [
[0] "Classic .NET AppPool"
],
"input_type" => "log",
"verb" => [
[0] "POST"
],
"source" => "Path\FailedReqLogFiles\W3SVC36\fr000181.xml",
"type" => "trace",
"url" => [
[0] "http://localhost:80/testapp4.0/default.aspx"
],
"tags" => [
[0] "beats_input_codec_plain_applied"
],
"@timestamp" => 2017-11-06T17:36:25.595Z,
"@version" => "1",
"beat" => {
"name" => "ServerName",
"hostname" => "ServerName",
"version" => "5.6.3"
},
"host" => "ServerName",
"statusCode" => [
[0] "500"
]
}

Any idea how parsing ambiguous name(Buffer)?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.