Parsing XML with self-closing tags


If I use logstash to parse XML with an self-closing tag (e.g. <foo />), it turns it into an empty object instead of an empty string. For example:

"parsed" => {
    "foo" => [
        [0] {}

How can I add a conditional to only call add_field if it's a string, not an empty object? If I do this:

if [parsed][foo][0] {
    mutate {
        add_field => {
            "foo" => "%{[parsed][foo][0]}"

the field "foo" gets the value "{}". I also tried checking if [parsed][foo][0] != "{}", but that didn't catch it.

(Mustafa KIRIMLI) #2

I'm not sure is it correct way or not, but i've solved this problem with removing empty (self closing) xml tags with mutate filter and gsub config. My code is below;

mutate { gsub => [ "message", "<(\s)?\w+(\s)?/>", "" ] }

(system) #3