Removing CDATA info from parsed log

(Kamen MacKay) #1

I have a xml log file for which I'm trying to extract the XML data from. I'm using the multiline filter in filebeat on the client machine to send it as one block to logstash. It's recognized as XML when Logstash ingests it. I'm using xpath to extract some fields and rename them which is working. However, when it pulls the value from the xpath section of my logstash conf like this:

xpath => [
"/request/header[3]/value/text()", "msg.user-agent" ]

logstash inserts it into "msg.user-agent" as <![CDATA[Java/1.8.0_66]]>. How do I remove the CDATA section so it just shows 'Java/1.8.0_66'

Here is a complete section from my log file as an example:





(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.