XML parser, alter field

[Soren_vdc]

Hi,

I have this setup for XML parser:

   xml {
    source => "message"
    target => "xml"
            add_field => {
                Audit_Type              => "%{[xml][Audit_Type]}"
                Ext_Name                => "%{[xml][Ext_Name]}"
        }
   }

For some documents the Ext_Name is empty and this value is shown in the document in ELK:
%{[xml][Ext_Name]}

To change that to "blank", I tried with this:

alter {
        condrewrite => [
"Ext_Name","%{[xml][Ext_Name]}",""

]
}

But this "%{[xml][Ext_Name]}" is not working because logstash will see this as variable. Is there a way to escape this in the alter plugin that logstash see this as text and not as variable?

thx!

[Soren_vdc]

I can change it by IF function:
if "xml][Ext_Name" in [Ext_Name]{ mutate{ replace => {"Ext_Name" => ""} }

But is there a procedure to search for the Value "xml][" in all fields and change to ""?

[Cad]

Hi,

Yes you can use gsub from mutate filter documentation

mutate {
    gsub => [
         "Ext_Name", "xml][", ""
    ]
}

Cad

[Badger]

You may be able to do this using a prune filter. The default operation of the filter is to remove any field that matches the regexp %{[^}]+}.