Unable to parse the xml tag and create a field in Elastic Search

[sdeven (Sathish)]

Hi,
I am using the http plugin in my logstash.conf file, where I am getting a XML document. I have to extract a tag from the XML document and make it as a field in elastic search. I am not getting any errors but the filed is not getting created when I see the kibana dashboard.

Logstash.config

Input {
 http {
    host => "0.0.0.0"
    port => "8080"
  }
}

filter {
    xml {
      source => "message"
      store_xml => false
      remove_namespaces => true
      xpath =>[ "/Document/student/id", "studentID"]
    }
}


output {
stdout { codec => rubydebug }
elasticsearch{
  hosts => ["localhost:9200"]
  index => "document"
  type => "patients"

}
}

xml Input

<?xml version="1.0" encoding="UTF-8"?>
<Document> 
    <student>
         <id>1234567</id>
    </student>
    <recordTarget>
          <role>
                   .....
                  ...... have multiple internal tags....
          </role>
    </recordTarget>
 </Document>

Can you please point out what is the mistake I am doing here. Thanks in advance

[Badger]

In the rubydebug output, what does the [message] field look like?

[sdeven (Sathish)]

@Badger below is the content of the message in the stdout

"message" => "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Document>\n    <student> \n        <Id>12345678</Id>\n    </student>\n <recordTarget>\n <role> \n
                   .....
                  ...... have multiple internal tags....
          </role>\n </recordTarget>\n </Document>\n"

[Badger]

@sdeven

xpath =>[ "/Document/student/id", "studentID"]

The document you showed has "/Document/student/Id", not "/Document/student/id". XML tags are case sensitive.

[sdeven (Sathish)]

@Badger Haa.. Silly mistake, Thanks alot for finding it. One more question on the same. If I have to use the same ID as an Attribute in the like the below

<?xml version="1.0" encoding="UTF-8"?>
<Document studentId="1234567"> 
    <recordTarget>
          <role>
                   .....
                  ...... have multiple internal tags....
          </role>
    </recordTarget>
 </Document>

can I use the Xpath as below

xpath =>[ "/Document/@studentId", "studentID"]

[Badger]

I would expect that to work.