Hey Guys ,
I already can sent a log to my logstash as my log is xml format , but the issue is logstash creating a new fields from tag as below :
I want to stop him creating the new fields from logMessage tag .
My config file :
input {
http {
host => "10.0.90.12"
port => 3131
}
}
filter{
mutate {
remove_field => ["body","Log"]
}
xml {
source => "message"
target => "doc"
remove_namespaces => true
force_array => false
remove_field => [ "logMessage" ]
}
}
output {
elasticsearch { hosts => ["10.0.90.12:9200"]
user => "elastic"
password => "****"
index => "datapower"
}
stdout
{
codec => plain
}
}
Thank you