XML + Mutate plugins not working as espected

[Alfonso_Diez (Alfonso Díez)]

Hello.
I've implement a filter where I read from a JMS queue a message that is an XML file.

Then, I use the XML plugin to map some fields with the paths of the XML as following:

xpath => [
"//Framework_Event/EventCode/text()", "EventCode",
"//Framework_Event/E2ERequestId/text()", "E2EId",
"//Framework_Event/ParentInstanceId/text()", "ParentAdapterInstanceId",
"//Framework_Event/InstanceId/text()", "AdapterInstanceId",
"//Framework_Event/CustomId/text()", "AdapterCustomId",
"//Framework_Event/Deepness/text()", "StageLevel",
"//Framework_Event/RequestTimeStamp/text()", "E2EStartTimeStamp",
]

As far as I know, this plugin always extracts an array from the indicated paths.

Then I extract the first element from the array:

mutate {
remove_field => [ "message" ]
replace => {
"EventCode" => "%{[EventCode][0]}"
"E2EId" => "%{[E2EId][0]}"
"ParentAdapterInstanceId" => "%{[ParentAdapterInstanceId][0]}"
"AdapterInstanceId" => "%{[AdapterInstanceId][0]}"
"AdapterCustomId" => "%{[AdapterCustomId][0]}"
"StageLevel" => "%{[StageLevel][0]}"
"E2EStartTimeStamp" => "%{[E2EStartTimeStamp][0]}"
}

the problem is that for those elements of the XML that are empty, the replace function is writing something like that in elastic:

"ParentAdapterInstanceId": "%{[ParentAdapterInstanceId][0]}",

How could I get a blank there instead of this?

many thanks in advance

[balumurari1]

try these,

if ![ParentAdapterInstanceId]{
mutate{
add_field => {"ParentAdapterInstanceId" => "null"}
}
}

or

if ![ParentAdapterInstanceId] {
mutate {
replace => {
"[ParentAdapterInstanceId]" => ""
}
}
}

[Alfonso_Diez (Alfonso Díez)]

Thank you very much, this solution works for me, but to make the code short what I have done is the following:

xpath => [
"concat(//Framework_Event/EventCode/text(), '')", "EventCode",
"concat(//Framework_Event/E2ERequestId/text(), '')", "E2EId",
"concat(//Framework_Event/ParentInstanceId/text(), '')", "ParentAdapterInstanceId",
"concat(//Framework_Event/InstanceId/text(), '')", "AdapterInstanceId",
"concat(//Framework_Event/CustomId/text(), '')", "AdapterCustomId",
"concat(//Framework_Event/Deepness/text(), '')", "StageLevel",
"concat(//Framework_Event/RequestTimeStamp/text(), '')", "E2EStartTimeStamp",
]

That avoid the content of the field to be null being always blank.