XML filter doesnt parse PacketBeat output

Elastic Stack Logstash
1

Hello,

I have Packetbeat that ships data to logstash. In the http body from PacketBeat I have XML that I want to apply xml filter, but it doesn't seem to work. Here is the configuration.

filter {
xml {
source => "body"
target => "xmlfile"
}
}

This is what I receive in logstash.

"body" => "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n Update\n \n \n \n \n \n service\n \n \n \n \n \n \n serviceO\n \n 0\n \n \n \n serviceO\n \n 4\n \n \n \n \n \n \n \n serviceO\n \n 0\n \n \n \n service\n \n 31\n \n \n \n \n \n \n \n \n \n origin\n \n 9633\n \n \n \n originTime\n \n <dateTime.iso8601>20161007T06:13:14-0700</dateTime.iso8601>\n \n \n \n sd\n \n 11111111111\n \n \n \n originNode\n \n SUSE\n \n \n \n originHostName\n \n SUSE\n \n \n \n origin\n \n AAA\n \n \n \n \n \n \n",

Any advise or suggestion is much appreciated.

P.S. When I feed same XML through file input all works well.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.