Hey! I'm a complete beginner to everything elasticsearch/logstash/kibana related, so please have mercy. I have a xml-File with many Eventlogs that is (simplified) structured like this: <xmldata> <Event> <Computer>...</Computer> ... <EventData> …

[image] Badger: code => ' FieldName = "[theXML][Event][EventData][Data]" e = event.get(FieldName) Oh, maybe init => ' FieldName = "[theXML][Event][EventData][Data]" ' code => ' e = event.get(FieldName) works? I cannot test it just now.

Thanks for the feedback and the code. I will give it a shot. The challenge is this is a piece of manufacturing equipment and each recipe has the same format but depending on the items it is inspecting them you will see a different count. What I posted was only 3 inspections on a printed circuit b…

First of all, sorry that it took me so long to reply, had no access to the files over the long weekend. Thanks for your input! So I guess there's not just a simple line to add to my filter as it was? Cause everything else was working fine, so I was hoping it wasnt all "useless". But I will try your…

Unfortunately that doesn't work for me. If I put it in like that, I get a xmlparsefailure and a split_type_failure as well. I also tried adding the missing [xmldata] before all of the [Events], but still not better. It all comes out as one message, not several Events. If I make the split like I did…

If you are getting an _xmlparsefailure tag then the [message] field is not valid XML. We cannot help you with that unless you can show us the actual [message] field.

Alright, I changed everythig back again so that it is exactly like your suggestion, and that's what I get for the message field: "message" => "<xmldata>\r\n<Event xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"><System><Provider Name=\"Microsoft-Windows-AAD\" Guid=\"{4de9bc9c-b27a-…

exception=>#<REXML::ParseException: No close tag for /xmldata Your multiline pattern is not capturing the close tag. If you want to consume the entire file you could use read mode for the file input. Alternatively, use a pattern that will never match and emit the event based on a timeout codec => …

what do you mean by read mode? Like I said, I'm completeley new to logstash, so sorry for the stupid questions, but google couldnt help me either. Also, why did it work with my original config file if I didn't change anything in the input-section?

A file input can operate in either tail more or read mode. The documentation explains what each one does. I cannot explain why the behaviour would have changed. I just know that your message is missing the close tag.

Alright, thank you, that seems to work in some ways now. Though now I get a ruby_exception: "no implicit conversion of String to Integer" for the Events that have a field with the name "Status" that contains something like "0xc00484b2", it works fine for the other Events without that field though. …

I figured out that the file gets deleted because of the read mode, it deletes the file after it's done with it by default. So I'm only left with the ruby_exception.

Discuss the Elastic Stack

Xml filtering subfields

Elastic Stack Logstash

Topic		Replies	Views
Indexing Xml subfields as a new field Logstash	12	1151	July 28, 2021
XML to Elasticsearch via Logstash Logstash	47	3668	April 3, 2018
Logstash XML Filter Plugin - XML Parsing General Question Logstash	6	229	June 19, 2024
Help with parsing XML content Logstash	16	19716	July 6, 2017
Logstash split xml fields Logstash	22	5494	July 14, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Xml filtering subfields

Related topics