XML parser, alter field


I have this setup for XML parser:

   xml {
    source => "message"
    target => "xml"
            add_field => {
                Audit_Type              => "%{[xml][Audit_Type]}"
                Ext_Name                => "%{[xml][Ext_Name]}"

For some documents the Ext_Name is empty and this value is shown in the document in ELK:

To change that to "blank", I tried with this:

alter {
        condrewrite => [


But this "%{[xml][Ext_Name]}" is not working because logstash will see this as variable. Is there a way to escape this in the alter plugin that logstash see this as text and not as variable?


I can change it by IF function:
if "xml][Ext_Name" in [Ext_Name]{ mutate{ replace => {"Ext_Name" => ""} }

But is there a procedure to search for the Value "xml][" in all fields and change to ""?


Yes you can use gsub from mutate filter documentation

mutate {
    gsub => [
         "Ext_Name", "xml][", ""


1 Like

You may be able to do this using a prune filter. The default operation of the filter is to remove any field that matches the regexp %{[^}]+}.