Unable to load xml file in logstash

Elastic Stack Logstash
1

Hello, can you please provide a sample example to upload xml file using logstash. I have tried a lot but unable to upload an xml file in logstash in windows machine. Waiting for the response.

Ex: My XML file is as follows,

--stations--
--station--
--id--Value1--/id--
--name>Value2--/name--
--/station--
--/stations--

My conf file is as follows,
input
{
file
{
path => "C:\Users\LENOVO\Downloads\stations.xml"
start_position => "beginning"
#sincedb_path => "/dev/null"
exclude => "*.gz"
type => "xml"
codec => multiline {
pattern => ""
negate => "true"
what => "previous"
}
}
}
filter
{
xml
{
source => "message"
store_xml => false
target => "stations"
xpath => [
"/stations/station/id/text()", "station_id",
"/stations/station/name/text()", "station_name"
]
}

}

output
{
elasticsearch
{
codec => json
hosts => "localhost"
index => "xmlns24"
}
stdout
{
codec => rubydebug
}
}

Please help me , i am not getting any output,,

2

Do you see any logs in the sdtout ?
It looks like the 9200 port is missing in your Elasticsearch output config.

3

thanks for the reply my elastic search is working fine.

when i run this on logstash, i am getting the following output as attached in the image

output
output.PNG640×597 19 KB

Waiting for your response.

Thanks in advance,
Balu

4

Hello, in my windows machine, i have changed my path from as shown below,
path => "C:\Users\LENOVO\Downloads\stations.xml"
to
path => "C:/Users/LENOVO/Downloads/stations.xml"

and sincedb_path => "NUL"out

and it is generating the response as shown above.
Please help me get correct output.

Thanks in advance

5

The correct output is obtained for below input code, hope this helps other people,
Also, max_lines number changes based on the maximum number of lines present in your xml file

input
{
file
{
path => "C:/Users/LENOVO/Downloads/stations.xml"
start_position => "beginning"
sincedb_path => "NUL"
codec => multiline {
pattern => "^<?stations.*>"
negate => "true"
what => "previous"
auto_flush_interval => 1
max_lines => 3000
}
}
}
filter
{
xml
{
source => "message"
target => "parsed"
store_xml => "false"
xpath => [
"/stations/station/id/text()", "station_id",
"/stations/station/name/text()", "station_name"
]
}
mutate {
remove_field => [ "message"]
}
}

output
{
stdout
{
codec => rubydebug
}
}