XML parsing logstash

Elastic Stack Logstash
1

Hi all,

I am currently using file beat to export all the below messages from application logs (XML) to ECS. But i like to parse the xml so only few required details are viewed in ECS.

I like to get the value of below tags by only filtering Message name, Ref ID, duration, time value in request/response and discard rest of the XML.

How can achieve that? Please assist.

Update server01 1234 http:\\server.com server 39 00:00:00.1220000 2018-08-09 00:05:10.41 this is a message<\rawmessage> 2018-08-09 00:05:10.532 this is a message<\rawmessage>
2

Have you looked at the xml filter? It's xpath option should be useful if you only want to extract a couple of fields from the document.

3

Is there an example i can follow?

4

I searched discuss.elastic.co for "xml filter xpath" and the first hit contained an example: XML XPath filter is parsing fields but not inserting in Elasticsearch

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.