Xml add field not working


(Saket Kumar) #1

filter {
xml {
add_field => { "visualComplete" => "[response][data][median][firstView][visualComplete]" }
}
}

Logstash 1.5.0:
Trying to add field "visualComplete" along with value and output to ELK but don't see any field with this name. Am I not doing it correctly.


(Ed) #2

The beginning of your filter is correct, though access existing fields would be %{fieldname} ....

From your example I don't see how you are creating the array of varables, Are you parsing the data prior to this filter ? Or I think you might find the option XPATH more to your liking

https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html#plugins-filters-xml-xpath


(system) #3