Unable to index xml file properly using logstash

Elastic Stack Logstash
1

Hi,

I am trying to index big xml file.

Below is my xml file.

input {
file {
path => "/Users/srini/Downloads/imp/2016-01-27/*.xml"
start_position => "beginning"
}
}

filter {
xml {
source => "message"
target => "xmldata"
store_xml => "false"
add_tag => [ "foo_%{somefield}" ]
}
}

output {
elasticsearch {
action => "index"
hosts => "127.0.0.1"
index => "srini2"

}
stdout { codec => json }
}

I have nested data.
The data when i searched in elasticsearch, it is indexing each line.
How can i make sure,

  1. Is there any mistake with my logstash config file.?
  2. index whole file instead of line. ?

Thank You,
Regards,
Srini.

2

The file input isn't geared towards this use case. You need to use a multiline codec to join all lines of the file into a single event or a completely different input plugin that can slurp the whole file at once (like exec).

3

Hi @magnusbaeck,

Thanks for the details. I have resolved with using multilines. I forgot to close the topic.