I have a nested xml document with multiple parents and children and i want to break this down to effectively be a linear list like...
<root> <child parent_id="1">Child 1</child> .... </root>
so i need to combine the parent data with the child data to form a complete record.
I have successfully managed to process all children of the first parent and access the parent data but cant figure out a way of breaking up the document twice or referring to the parent element when processing a child.
<root> <parent id="1"> <child>Child 1</child> <child>Child 2</child> </parent> <parent id="2"> <child>Child 1</child> <child>Child 2</child> </parent> </root>
in the xml filter I can only seem to split on
[parent][0][child]
in general i am trying to see if logstash is flexible enough to deal with ad heterogenous xml docs (differetn structure from different clients) - im thinking currently that it isnt and that im better processing them first and producing a standard output for logstash to ingest.