Set target of xml filter to root?

Elastic Stack Logstash
1

I want the store_xml setting of the xml filter to store child elements of the input XML event as top-level fields.

Is this possible? Or should I create an issue in GitHub for this?

For example, given this input XML event:

<event>
  <property1>v1</property1>
  <property2>v2</property2>
</event>

I want this output:

"@timestamp":"...",
"property1":"v1",
"property2":"v2"

not, say:

"@timestamp":"...",
"xml_content": {
  "property1":"v1",
  "property2":"v2"
}

And to do that, I’d prefer not to mess around individually creating new top-level fields from the store_xml target, and then removing that target (or using a target under @metadata).

For example, is there some existing “Logstash field reference syntax” that I can use to represent “root” as the value of the target setting?

2

My gut reaction would've been to use an empty target, but that's not allowed (it might even have been me who wrote the piece of code that rejects empty targets). Since there's no other way of denoting the root I don't think it's possible to store the results from an xml filter anywhere except under an existing field.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.