Unable to parse the xml tag and create a field in Elastic Search

Elastic Stack Logstash
1

Hi,
I am using the http plugin in my logstash.conf file, where I am getting a XML document. I have to extract a tag from the XML document and make it as a field in elastic search. I am not getting any errors but the filed is not getting created when I see the kibana dashboard.

Logstash.config

Input {
 http {
    host => "0.0.0.0"
    port => "8080"
  }
}

filter {
    xml {
      source => "message"
      store_xml => false
      remove_namespaces => true
      xpath =>[ "/Document/student/id", "studentID"]
    }
}


output {
stdout { codec => rubydebug }
elasticsearch{
  hosts => ["localhost:9200"]
  index => "document"
  type => "patients"

}
}

xml Input

<?xml version="1.0" encoding="UTF-8"?>
<Document> 
    <student>
         <id>1234567</id>
    </student>
    <recordTarget>
          <role>
                   .....
                  ...... have multiple internal tags....
          </role>
    </recordTarget>
 </Document>

Can you please point out what is the mistake I am doing here. Thanks in advance

2

In the rubydebug output, what does the [message] field look like?

3

@Badger below is the content of the message in the stdout

"message" => "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Document>\n    <student> \n        <Id>12345678</Id>\n    </student>\n <recordTarget>\n <role> \n
                   .....
                  ...... have multiple internal tags....
          </role>\n </recordTarget>\n </Document>\n"
4

The document you showed has "/Document/student/Id", not "/Document/student/id". XML tags are case sensitive.

5

@Badger Haa.. Silly mistake, Thanks alot for finding it. One more question on the same. If I have to use the same ID as an Attribute in the like the below

<?xml version="1.0" encoding="UTF-8"?>
<Document studentId="1234567"> 
    <recordTarget>
          <role>
                   .....
                  ...... have multiple internal tags....
          </role>
    </recordTarget>
 </Document>

can I use the Xpath as below

xpath =>[ "/Document/@studentId", "studentID"]
6

I would expect that to work.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.