XML filter, parse key

Elastic Stack Logstash
#1

Hi all, i am parsing a xml, my problem is that one of the kml key is having the action so i am wondering to save that key in one field is that possible?

<action >
     <ip></ip>
     <mac>asdasdreg</mac>
     <TimeStamp>2018-08-26T08:14:29-08:00</TimeStamp>
</action>

regards

#2

It's not clear to me what you're looking for. Could you give an example of the desired outcome?

#3

Yes. i have multiple xml logs supose that i have

<action >
 <ip></ip>
 <mac>asdasdreg</mac>
 <TimeStamp>2018-08-26T08:14:29-08:00</TimeStamp>

<action2 >
 <ip></ip>
 <mac>asdasdreg</mac>
 <TimeStamp>2018-08-26T08:14:29-08:00</TimeStamp>

the thing is that i want to parse the xml and then add a field with the action name (action or action2) in this example. Is that possible?

regards

#4

Hmm. I guess you'll have to use an xml filter with store_xml => true to parse the entire XML, then use a ruby filter to check what fields you got and store the name of one of the fields in another field.

#5

i cant use the name here()?

regards

#6

I don't understand what you mean.

#7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.