Hi @Badger I'm Trying to parse the log file with below xml
<imm:IMM-contents xmlns:imm="http://www.saforum.org/IMMSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="SAI-AIS-IMM-XSD-A.02.13.xsd">
<class name="OpenSafAmfConfig">
<category>SA_CONFIG</category>
<rdn>
<name>amfConfig</name>
<type>SA_STRING_T</type>
<category>SA_CONFIG</category>
<flag>SA_INITIALIZED</flag>
</rdn>
<attr>
<name>osafAmfRestrictAutoRepairEnable</name>
<type>SA_UINT32_T</type>
<category>SA_CONFIG</category>
<flag>SA_WRITABLE</flag>
</attr>
<attr>
<name>osafAmfDelayNodeFailoverTimeout</name>
<type>SA_TIME_T</type>
<category>SA_CONFIG</category>
<flag>SA_WRITABLE</flag>
</attr>
<attr>
<name>osafAmfDelayNodeFailoverNodeWaitTimeout</name>
<type>SA_TIME_T</type>
<category>SA_CONFIG</category>
<flag>SA_WRITABLE</flag>
</attr>
</class>
my pipeline
input {
file {
path => "/etc/logstash/imm.xml"
start_position => "beginning"
sincedb_path => "/dev/null"
codec => multiline {
pattern => "<class name"
negate => true
what => "previous"
}
}
}
filter
{
mutate { gsub => [ "message", "<.xml version.>", "" ] }
mutate { gsub => [ "message", "<imm:IMM-contents.>", "" ] }
xml
{
source => "message"
remove_namespaces => true
store_xml => false
#target => "theXML"
xpath => [
"/class/@name", "class_name",
"/class/category/text()", "class_category",
"/class/rdn/name/text()", "rdn_name",
"/class/rdn/type/text()", "rdn_type",
"/class/rdn/category/text()", "rdn_category",
"/class/rdn/flag/text()", "rdn_flag",
"/class/attr/name/text()", "attr_name",
"/class/attr/type/text()", "attr_type",
"/class/attr/category/text()", "attr_category",
#"/job_list/hard_request[@name]", "hard_request",
"/class/attr/flag/text()", "attr_flag",
"/class/attr/default-value/text()", "default_value"
]
}
mutate {
rename => [
"[class_name][0]", "class_name",
"[class_category][0]", "class_category",
"[rdn_name][0]", "rdn_name",
"[rdn_type][0]", "rdn_type",
"[rdn_category][0]", "rdn_category",
"[rdn_flag][0]", "rdn_flag",
"[attr_name][0]", "attr_name",
"[attr_type][0]", "attr_type",
"[attr_category][0]", "attr_category",
"[attr_flag][0]", "attr_flag",
"[default_value][0]", "default_value"
]
}
}
output
{
stdout { codec => rubydebug }
}
I want every rdn adn attr as an event or element not in a single count . instead of i want all with every element..
Please help me on this ..