Xml parcing problem

Elastic Stack Logstash
1

Hello everyone, I'm trying to parse the xml file, but the logstach configuration fails below, their hml needs to pull out only the value of the web container, but for some reason everything gets into the message field

xml {
 target => "doc"
 store_xml +> false
 source => "message"
 xpath => ["/Stats/@name", "name"]
 xpath => ["/Stats/BRS/@cur", "Current"]
}
 xml file is bellow
    indent preformatted text by 4 spaces
<?xml version="1.0" encoding="UTF-8"?>
<Snapshot time="1559836472362">
<Stats name="WMQJCAResourceAdapter" statType="threadPoolModule" il="-2" type="COLLECTION">
<BRS id="3" lWM="0" hWM="1" cur="0" int="967.0" sT="1559799678760" lST="1559836472143" lB="0" uB="0">
</BRS>
<BRS id="4" lWM="1" hWM="10" cur="1" int="1.9528504E7" sT="1559799678760" lST="1559836472143" lB="10" uB="50">
</BRS>
<CS id="6" sT="1559799711817" lST="1559799711817" ct="0">
</CS>
<CS id="7" sT="1559799711817" lST="1559799711817" ct="0">
</CS>
<RS id="8" sT="1559799711817" lST="1559836472143" lWM="0" hWM="0" cur="0" int="0.0"></RS>
</Stats>
<Stats name="WebContainer" statType="threadPoolModule" il="-2" type="COLLECTION">
<BRS id="3" lWM="1" hWM="76" cur="73" int="1.38463928E8" sT="1559799674049" lST="1559836472143" lB="0" uB="0">
</BRS>
<BRS id="4" lWM="1" hWM="76" cur="76" int="1.132993425E9" sT="1559799674049" lST="1559836472143" lB="50" uB="500">
</BRS>
<CS id="6" sT="1559799711817" lST="1559799711817" ct="0">
</CS>
<CS id="7" sT="1559799711817" lST="1559799711817" ct="0">
</CS>
<RS id="8" sT="1559799711817" lST="1559836472143" lWM="0" hWM="0" cur="0" int="0.0"></RS>
</Stats>
<Stats name="WorkManager.AsynchLogWriteWorkManager" statType="threadPoolModule" il="-2" type="COLLECTION">
<BRS id="3" lWM="0" hWM="300" cur="205" int="8.59293321E8" sT="1559808597889" lST="1559836472143" lB="0" uB="0">
</BRS>
<BRS id="4" lWM="1" hWM="300" cur="212" int="1.74246295E9" sT="1559808597889" lST="1559836472143" lB="100" uB="300">
</BRS>
<CS id="6" sT="1559808597889" lST="1559836395703" ct="126">
</CS>
<CS id="7" sT="1559808597889" lST="1559808597889" ct="0">
</CS>
<RS id="8" sT="1559808597889" lST="1559836395703" lWM="1" hWM="126" cur="126" int="6.86019366E8"></RS>
</Stats>
</Snapshot>

but in index all information in message

2

You need to include Snapshot in the xpath values

    xml {
        target => "doc"
        store_xml => false
        source => "message"
        xpath => {
            "/Snapshot/Stats/@name" => "name"
            "/Snapshot/Stats/BRS/@cur" => "Current"
        }
    }

The xpath option expects a hash. Specifying an option multiple times will work in every case except where it does not work. In that case it will confuse the hell of you. It does not matter in this case, but using an option only once is a good habit to get into.

3

I tried your config, but it does not work, all the fields to into the message

I simplified the task and left the most minimal and even with it all the parameters come in the message field

image
image.png1920×1040 10.4 KB

in fact, I need only parameter cur="73" if Stats name="WebContainer" and BRS id="3" need to pull out these values, I tried everything but nothing helps

4

I try it
/Snapshot/Stats[@name='WebContainer']/BRS[@id='4']/@cur
in this work very goot


but not work in logstash.
"/Snapshot/Stats[@name='WebContainer']/BRS[@id='4']/@cur", "WebContainer"
all info go to message

5

It works in logstash as well.

    xml {
        target => "doc"
        store_xml => false
        source => "message"
        force_array => false
        xpath => {
            "/Snapshot/Stats/@name" => "name"
            "/Snapshot/Stats[@name='WebContainer']/BRS[@id='4']/@cur" => "Current"
        }
    }

produces

      "name" => [
    [0] "WMQJCAResourceAdapter",
    [1] "WebContainer",
    [2] "WorkManager.AsynchLogWriteWorkManager"
],
   "Current" => "76",

in 7.1.1

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.