here is a sample of my xml file
this is the first time I want to use an xml filter and I am lost. how can I use an xsd structure for it and how can I map value types
Please post text, not screen shots.
okay sorry he is the text
<measCollecFile xmlns="http://www.3gpp.org/ftp/specs/archive/32_series/32.435#measCollec">
<fileHeader fileFormatVersion="32.435 V9.0" vendorName="Ericsson">
<fileSender/>
<measCollec beginTime="2019-01-17T03:00:00+02:00"/>
</fileHeader>
<measData>
<managedElement localDn="AdmMME"/>
<measInfo measInfoId="SGSN-MME_BSSGP">
<job jobId="25014551_USERDEF.SGSN_KPIs_counters.Profile_25014551.Continuous_Y.MEASJOB"/>
<granPeriod duration="PT900S" endTime="2019-01-17T03:15:00+02:00"/>
<repPeriod duration="PT900S"/>
<measType p="1">bssgpAttResumeProc</measType>
<measType p="2">bssgpAttSuspendProc</measType>
<measType p="3">bssgpDownlinkPacketsBuff</measType>
<measType p="4">bssgpDownlinkPacketsBuffBucketFull</measType>
<measType p="5">bssgpDownlinkPacketsBuffLlcSuspend</measType>
<measType p="6">bssgpDownlinkPacketsBuffMobileSuspend</measType>
<measType p="7">bssgpDownlinkPacketsBuffSnapshot</measType>
<measType p="8">bssgpDownlinkPacketsDiscardLlcSuspended</measType>
<measType p="9">bssgpDownlinkPacketsDiscardedBucketFull</measType>
<measType p="10">bssgpDownlinkPacketsDiscardedBvcBlocked</measType>
<measType p="11">bssgpDownlinkPacketsDiscardedMobileSuspend</measType>
<measValue measObjLdn="ManagedElement=AdmMME,SgsnFunction=1">
<r p="1">955</r>
<r p="2">23697</r>
<r p="3">58797</r>
<r p="4">41276</r>
<r p="5">12427</r>
<r p="6">88</r>
<r p="7">1619</r>
<r p="8">2258</r>
<r p="9">6570</r>
<r p="10">0</r>
<r p="11">36</r>
</measValue>
</measInfo>
<measInfo measInfoId="SGSN-MME_BSSGP_Nse">
<job jobId="25014551_USERDEF.SGSN_KPIs_counters.Profile_25014551.Continuous_Y.MEASJOB"/>
<granPeriod duration="PT900S" endTime="2019-01-17T03:15:00+02:00"/>
<repPeriod duration="PT900S"/>
<measType p="1">bssgpDownlinkOctets</measType>
<measType p="2">bssgpDownlinkPackets</measType>
<measType p="3">bssgpDownlinkPacketsSignalling</measType>
<measType p="4">bssgpStatusBvcUnknown</measType>
<measType p="5">bssgpUplinkOctets</measType>
<measType p="6">bssgpUplinkPackets</measType>
<measType p="7">bssgpUplinkPacketsSignalling</measType>
<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,GbIp=1,GbIpNse=111">
<r p="1">708755287</r>
<r p="2">1313662</r>
<r p="3">176092</r>
<r p="4">0</r>
<r p="5">258079376</r>
<r p="6">1640366</r>
<r p="7">178163</r>
</measValue>
<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,GbIp=1,GbIpNse=77">
<r p="1">60</r>
<r p="2">15</r>
<r p="3">15</r>
<r p="4">0</r>
<r p="5">345</r>
<r p="6">15</r>
<r p="7">15</r>
</measValue>
</measInfo>
<measInfo measInfoId="SGSN-MME_Ethernet">
<job jobId="25014551_USERDEF.SGSN_KPIs_counters.Profile_25014551.Continuous_Y.MEASJOB"/>
<granPeriod duration="PT900S" endTime="2019-01-17T03:15:00+02:00"/>
<repPeriod duration="PT900S"/>
<measType p="1">ethInErrors</measType>
<measType p="2">ethOutErrors</measType>
<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=0">
<r p="1">0</r>
<r p="2">0</r>
</measValue>
<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=1">
<r p="1">0</r>
<r p="2">0</r>
</measValue>
<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=2">
<r p="1">0</r>
<r p="2">0</r>
</measValue>
<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=3">
<r p="1">0</r>
<r p="2">0</r>
</measValue>
<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=4">
<r p="1">0</r>
<r p="2">0</r>
</measValue>
<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=5">
<r p="1">0</r>
<r p="2">0</r>
</measValue>
<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=6">
Your XML is not valid. It is missing </measData> and </measCollecData.
Assuming your input includes those, you need to consume the entire XML as a single event. You can probably do that using a multiline codec on a file input, or in filebeat if you are using that.
Once you have valid in an event there are two approaches to parsing it. One is to use
xml {
source => "message"
target => "theXML"
store_xml => true
}
that gets you the entire message structure with the field theXML. Note that almost everything is an array. For example,
"theXML" => {
"xmlns" => "http://www.3gpp.org/ftp/specs/archive/32_series/32.435#measCollec",
"measData" => [
[0] {
"measInfo" => [
[0] {
"measInfoId" => "SGSN-MME_BSSGP",
"granPeriod" => [
[0] {
"duration" => "PT900S",
"endTime" => "2019-01-17T03:15:00+02:00"
}
],
"measType" => [
[ 0] {
"p" => "1",
"content" => "bssgpAttResumeProc"
},
[...]
],
"fileHeader" => [
[0] {
"vendorName" => "Ericsson",
"fileFormatVersion" => "32.435 V9.0",
"fileSender" => [
[0] nil
],
[...]
},
The alternative is xpath. And for the life of me I cannot get this to work with your data. I tried many variants of this and I cannot extract either elements or attributes. Maybe someone else can suggest something.
xml {
source => "message"
store_xml => false
xpath => { '/measCollecFile/fileHeader/measCollec/@beginTime' => "begin" }
}Thank you for your reply, well it has an xds schema if there is a way to map it to it since it is a bit complicated xml file
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.