Parsing XML with self-closing tags


#1

If I use logstash to parse XML with an self-closing tag (e.g. <foo />), it turns it into an empty object instead of an empty string. For example:

"parsed" => {
    "foo" => [
        [0] {}
    ]
}

How can I add a conditional to only call add_field if it's a string, not an empty object? If I do this:

if [parsed][foo][0] {
    mutate {
        add_field => {
            "foo" => "%{[parsed][foo][0]}"
        }
    }
}

the field "foo" gets the value "{}". I also tried checking if [parsed][foo][0] != "{}", but that didn't catch it.


(Mustafa KIRIMLI) #2

I'm not sure is it correct way or not, but i've solved this problem with removing empty (self closing) xml tags with mutate filter and gsub config. My code is below;

mutate { gsub => [ "message", "<(\s)?\w+(\s)?/>", "" ] }


(system) #3