Hi, I am trying to get grok to target certain fields and extract the content that follows. For example: <c_port>3186</c_port> I want to find c_port and extract the number that follows, in this case 3186. I have tried number of ways and cant seem to get this functionality. Thank you.

I figured out how to get it done when there is a namespace... xml { source => "message" store_xml => false namespaces => { "ns2" => "http://www.yahoo.com/wcf/log/v1_0" } xpath => { "/ns2:bcLogEntry/c_port/text()" => "c_port" } } mutate { replace => { "c_p…

Targeting Field Content

Elastic Stack Logstash

teej September 22, 2020, 4:06pm 6

Thank you Kavierkoo.
As Badger suggested, I would prefer to use the XML filter or grok option but I can't seem to find how to make either of those two give me the value (3186) that follows that field (<c_port>). Can I get a hint on how I may incorporate the XML filter or grok to accomplish this?

Topic		Replies	Views
Custom log parsing that has xml contents in ELK Logstash	3	427	February 24, 2017
Logstash extract part of field Logstash	3	244	June 7, 2022
Usage of grok filter Logstash	3	477	March 25, 2019
Issue in using xpath in xml filter Logstash	3	1241	February 28, 2019
Extract and add field Logstash	8	1152	July 6, 2017

Targeting Field Content

Related topics