Using XPath to Create Field Names

Elastic Stack Logstash
1

Trying to use xpath to create the field name in a filter.

    filter {
      xml {
        source => "message"
        store_xml => false
        xpath => [
          "//XmlTag/text()",
           "//XmlTag/@name"
          ]
      }
    }

Is this something which is possible does anybody know?

2

I do not believe this is supported.

3

Ah okay, thank you for your reply. Is there a solution to this issue using another filter type? e.g. getting your field name from the data that is parsed?

4

Well, you could use a ruby filter to add a field based on the value of another field.

ruby { code => 'event.set( event.get("fieldContainingFieldName"), event.get("fieldContainingFieldValue") )' }
5

I'm not too familiar with this type of filter, so I'll go get researching.

Thank you very much for your help Badger!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.