XML into JSON value

Elastic Stack Logstash
1

Hey,

If i have a Json message, into has an element "error" : "<?xml version=\"1.0\" encoding=\"UTF-8\"?> zefzefzfzef "

how can extract and parse XML for create a sub-doc with all element xml
example :
"json" : "valueJson"
"error" : {
"xmlRoot" : {
"a" : "zefzefzfzef"
}
}

into logstash config :
in my filter {
json {
source => "message"
}
xxx
xxxx
xml {
source => "message.error"
target => "xmlFormatted"
}
} // end filter

thanks.

2

Please edit your post to show the actual value of the XML. In the text edit box select the XML and click on </> in the tool bar. Otherwise the XML will be consumed by the browser as if it were HTML.

3

Can you put the message or event.original field?

4

i have this xml example into value of one element Json.

"<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<begin>
   <error>
           <a>zeffzefzef</a>
  </error>
</bebin>"

simple ? if i do in filter first JSON

json {
      source => "message"
}

i have Json correctly structured into Elasticseach.
now if i do a second into the same filter:

xml {
   source => "message.error"
   target => "xmlFormatted"
}

normaly logstash take the message (in Json structure) and now the XML function take "message"->"error" and Parse xml for add fields from xml .

5

Let's assume you have JSON like this:

{
    "json" : "valueJson",
	"xmlRoot" : "<?xml version=\"1.0\" encoding=\"UTF-8\"?>
    <begin>
       <error>
           <a>zeffzefzef</a>
		</error>
	</begin>"
}

The filter should be:

filter {
   mutate { gsub => [ "message", "\s\s+", "" ] }

  json {
    source => "message"
  }
  
  xml {
    source => "xmlRoot"
    target => "xmlFormatted"
  }
	 
}

Result:

{
         "message" => "{\"json\" : \"valueJson\",\"xmlRoot\" : \"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?><begin><error><a>zeffzefzef</a></error></begin>\"}\r",
            "json" => "valueJson",
         "xmlRoot" => "<?xml version=\"1.0\" encoding=\"UTF-8\"?><begin><error><a>zeffzefzef</a></error></begin>",
    "xmlFormatted" => {
        "error" => [
            [0] {
                "a" => [
                    [0] "zeffzefzef"
                ]
            }
        ]
    }
}
6

thank you, I will try tomorrow at work, and return here for result.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.