Xml filter Xpath nested fields

Elastic Stack Logstash
1

Hello,
I have an xml file witch is a collection of tags like this:

<COMMAND name="ADDRESS.WRITE" timestamp="1621246484916" so="14">
        <SVLOBJECT>
            <LONG name="ADR_SEQ" val="1"/>
            <LONG name="TTL_ID" val="1"/>
            <STRING name="ADR_LNAME" val="Soci?t? BenAmara pour la Mode"/>
            <STRING name="ADR_FNAME" val="Soci?t? BenAmara pour la Mode"/>
            <STRING name="ADR_STREET" val="AIN DERAHEM"/>
            <STRING name="ADR_STREETNO" val="0"/>
            <STRING name="ADR_ZIP" val="8100"/>
            <STRING name="ADR_CITY" val="JENDOUBA"/>
            <STRING name="LNG_CODE_PUB" val="FR"/>
            <STRING name="ADR_STATE" val="JENDOUBA"/>
            <STRING name="ADR_TAXNO" val="4402263N"/>
            <LONG name="IDTYPE_CODE" val="2"/>
            <STRING name="ADR_IDNO" val="01104833"/>
            <DATE name="ADR_BIRTHDT" year="1962" month="2" day="26"/>
            <STRING name="ADR_SOCIALSENO" val="01104833"/>
            <STRING name="ADR_DRIVELICENCE" val="2"/>
            <CHAR name="ADR_SEX" val="M"/>
            <CHAR name="ADR_CUSTTYPE" val="C"/>
            <STRING name="MAS_CODE_PUB" val="SING"/>
            <STRING name="ADR_NATIONALITY_PUB" val="TUN"/>
            <STRING name="CS_ID_PUB" val="CUST0009977556"/>
            <LONG name="COUNTRY_ID" val="1"/>
        </SVLOBJECT>
    </COMMAND>

my logstash filter is something like this:

 xml{
        source => "message"
        store_xml => false
        force_array => false
        xpath => ["/COMMAND/SVLOBJECT//*[not(name()='LIST')]/@name", "[Parameter][name]"]
        xpath => ["/COMMAND/SVLOBJECT//@val", "[Parameter][value]"]
    }

This works for attributes name and val, except I would like to have an object for <DATE/> element inside [Parameter][value], maybe something like this:

xpath => ["/COMMAND/SVLOBJECT//@*[local-name() = 'year' or local-name() = 'month' or local-name() = 'day']", "[Parameter][value][date]"]

Except this does not parse the <DATE/> element at all.
Is there a limit to nested field? If so, how would I go about adding this field in the right index of the value array?

Thank you for your help.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.