Xml filter - how to view/ output json as logstash sees it

Elastic Stack Logstash
1

I'm using the xml filter and a ruby script to access nested nodes. What I am no clear on is the exact structure of the json which the ruby script will be acecssing, so I'm not sure how to write the event.get statement.

For example, if my input is this XML file:

{
	"us-patent-application": {
		"us-bibliographic-data-application": {
			"invention-title": {
				"_id": "d2e61",
				"__text": "LAND ROLLER"
			},
			"us-parties": {
				"us-applicants": {
					"us-applicant": {
						"addressbook": {
							"orgname": "Degelman Industries Ltd.",
							"address": {
								"city": "Regina",
								"country": "CA"
							}
						},
						"residence": {
							"country": "CA"
						},
						"_sequence": "00",
						"_app-type": "applicant",
						"_designation": "us-only",
						"_applicant-authority-category": "assignee"
					}
				},
				"inventors": {
					"inventor": [
						{
							"addressbook": {
								"last-name": "Evans",
								"first-name": "Miles",
								"address": {
									"city": "Emerald Park",
									"country": "CA"
								}
							},
							"_sequence": "00",
							"_designation": "us-only"
						},
						{
							"addressbook": {
								"last-name": "Lucas",
								"first-name": "Kelly",
								"address": {
									"city": "Regina",
									"country": "CA"
								}
							},
							"_sequence": "01",
							"_designation": "us-only"
						},
						{
							"addressbook": {
								"last-name": "Degelman",
								"first-name": "Scott R.",
								"address": {
									"city": "Regina",
									"country": "CA"
								}
							},
							"_sequence": "02",
							"_designation": "us-only"
						}
					]
				}
			},
			"_lang": "EN",
			"_country": "US"
		},
		"_lang": "EN"
	}
}

Here is my event.get call in ruby:

fname = event.get('[message][us-patent-application][0][us-bibliographic-data-application][0][us-parties][0][inventors][0][inventor][i][addressbook][0][last-name][0]')

But I get back 'Nil'. I assume this is because I'm not calling the json correctly. What will the json look like after it's run through the xml filter? How do I see that, so I can adjust my code a needed?

Any help would be appreciated.

2

Dump the raw event with e.g. a stdout { codec => rubydebug } output.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.