Reading XML Attribute using XPATH in logstash

Elastic Stack Logstash
1

Hi

I am trying to parse below XML file in logstash.

 <OrderEvent actionCode = "5">
 <OrderNumber>ORD12345</OrderNumber>
 <VendorNumber>V11111</VendorNumber>
 </OrderEvent>

I was able to successfully parse OrderNumber and VendorNumber from the log. But I am not able to fetch actionCode from the XML.

Can anyone please help me.

Below is the snippet of the logstash for XML parsing.

if [fields][log_type] == "XMLs" {
		xml {
				source => "message"
				store_xml => false
				namespaces => {
					"xsl" => "http://www.w3.org/1999/XSL/Transform"
					"xhtml" => "http://www.w3.org/1999/xhtml"
				}
				xpath => ["/OrderEvent/title()", "ActionCode","/OrderEvent/OrderNumber/text()", "OrderNumber","/OrderEvent/VendorNumber/text()", "VendorNumber"]
				
			}
					
		mutate { 
		add_field => ["Promotion_Source", "XMLs"]
		
		}
	}

Thanks

2

try to use something like this for the xpath expression

/OrderEvent/@actionCode

got it form here
https://www.w3schools.com/xml/xpath_syntax.asp

3 Likes
3

Hi

Thanks a lot for your response and help.

My issue has been resolved by the resolution provided by you.

Thanks

4

we can generate xpath by giving xml data as input from online, with this link,

http://xmltoolbox.appspot.com/xpath_generator.html

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.