Parsing XML document contained in a field

Elastic Stack Logstash
1

We have written a logstash configuration file with kv filter plugin to extract key-value pairs successfully. Some of the values is the keys contains XML documents as example below. What is the better way to parse the XML document contained in a field to extract the fields contained in the XML document?

<any>
	<xcap:MMTel-extension xmlns:xcap=\"http://uri.etsi.org/ngn/params/xml/simservs/xcap\">
		<xcap:basic-part>
			<xcap:call-source-code>710</xcap:call-source-code>
			<xcap:call-out-authority>
				<xcap:local>true</xcap:local>
				<xcap:local-toll>true</xcap:local-toll>
				<xcap:national-toll>true</xcap:national-toll>
				<xcap:international-toll>true</xcap:international-toll>
				<xcap:intra-local-toll>true</xcap:intra-local-toll>
				<xcap:intra-national-toll>true</xcap:intra-national-toll>
				<xcap:customized-call-out-authority1>true</xcap:customized-call-out-authority1>
				<xcap:customized-call-out-authority2>true</xcap:customized-call-out-authority2>
				<xcap:customized-call-out-authority3>true</xcap:customized-call-out-authority3>
			</xcap:call-out-authority>
			<xcap:user-category>ordinary</xcap:user-category>
			<xcap:user-password>******</xcap:user-password>
			<xcap:charge-mode>online-charging-and-offline-charging</xcap:charge-mode>
			<xcap:charge-source-code>27</xcap:charge-source-code>
			<xcap:limit-group>65535</xcap:limit-group>
			<xcap:limitation-of-parallel-calls>1</xcap:limitation-of-parallel-calls>
			<xcap:implicit-ua-profile-subscribe>true</xcap:implicit-ua-profile-subscribe>
			<xcap:carrier-pre-selection>
				<xcap:high-priority-cps-index>255</xcap:high-priority-cps-index>
				<xcap:local-cps-index>255</xcap:local-cps-index>
				<xcap:national-cps-index>255</xcap:national-cps-index>
				<xcap:international-cps-index>255</xcap:international-cps-index>
				<xcap:mobile-cps-index>255</xcap:mobile-cps-index>
			</xcap:carrier-pre-selection>
		</xcap:basic-part>
	</xcap:MMTel-extension>
	<Compress>0</Compress>
	<CheckSum>0</CheckSum>
</any>
2

Use an xml filter.

1 Like
3

Can you please provide an example with reference to the XML document attached?

4

If you have a field containing XML you can parse the whole XML document using

xml { source => "someField" store_xml => true target => "theXML" }

If you want to pick a subset of the fields out of the document you can use the xpath option instead. There are many examples in this forum.

1 Like
5

I have used the XML filter plugin in this manner and it is working perfectly;

xml {
source => "SourceField"
target => "DestinationField"
force_array => false
}

Thanks @Badger for some comments.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.