XML attributes and arrays

Elastic Stack Logstash
1

Hi, what about parsing this XML with Logstash

<root>
  <level1>
    <item name="item1" value="10">
    <item name="item2" value="20">
    <item name="item3" value="30">
    </service>
  </level1>
</root>

I'm using the following Xpath filter:

xml {
  source => "message"
  store_xml => "false"
  remove_namespaces => "true"
  xpath => ["root/level1/item/@name", "ItemName"]
  xpath => ["root/level1/item/@value", "ItemValue"]
}

However, this creates two separate arrays: [item1, item2, item3] and [10, 20, 30].
I would like to keep the correspondence between items and values.

Any ideas?

2

I think I've found a viable solution, but it requires perfect knowledge of all possible attributes names:

xml {
  source => "message"
  store_xml => "false"
  remove_namespaces => "true"
  xpath => ["root/level1/item[@name='item1']/@value", "Item1Value"]
  xpath => ["root/level1/item[@name='item2']/@value", "Item2Value"]
  xpath => ["root/level1/item[@name='item3']/@value", "Item3Value"]
}
3

Instead of using XPath, can you parse and store the whole document? And weed out the fields you don't need (the prune filter might help)? Alternatively, use a ruby filter to join the two arrays in your first solution.