so i need to combine the parent data with the child data to form a complete record.
I have successfully managed to process all children of the first parent and access the parent data but cant figure out a way of breaking up the document twice or referring to the parent element when processing a child.
in general i am trying to see if logstash is flexible enough to deal with ad heterogenous xml docs (differetn structure from different clients) - im thinking currently that it isnt and that im better processing them first and producing a standard output for logstash to ingest.
I am starting with that. I can see how to do it if i only ever have 1 parent but when there are muliple parent / children blocks thats what i cant see how to break it down.
You can then re-arrange the fields as you want them.
If you really want to transform one XML document that has parents with nested children into an XML document that has a list of children with a parent attribute I don't think logstash is the tool you want. Maybe XLST?
Bugger a duck. Im sure i tried something like that. That does work - thanks. I will give XSLT and i believe you can write python snippets a go perhaps but they are outside of my knowledge currently.
Useful but no. it was just the flattening capability i was looking for. That was just an example of how the xml feed could have come in and not be nested i.e. more simple to deal with from what id seen from other examples. We will probably want to index into Elastic Search.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.