XML Plugin - How to make an attribute filed a key

Elastic Stack Logstash
1

I have used Beats and Logstash extensively in the past for shipping and analyzing logs with ES and Kibana. For this project I'm looking at taking XML files from our test system, RobotFramework, and piping them into ES for analysis. I'm not an XML expert so please excuse me if I'm using the wrong nomenclature.

I have the following XML document:

<?xml version="1.0" encoding="UTF-8"?>
<robot generated="20171114 00:42:17.928" generator="Robot 3.0.2 (Python 2.7.12 on win32)">
<metadata>
  <item name="Board Temperature">32.0</item>
  <item name="Cell1 Ant DBm">-73</item>
  <item name="Cell1 Loss Offset">-9</item>
  <item name="Cell2 Ant DBm">-77</item>
  <item name="Cell2 Loss Offset">-9</item>
</metadata>
</robot>

I would like the all of the item tags to show up in ES as Key / Values with the Key being the name attribute and the value being the tags text. For example

"record" : {
  "Board Temperature": "32.0",
  "Cell1 Ant DBm": "-73"
}

I have the follow Logstash code working but I'm a bit stumped on how to get it structured properly. I would like to avoid the Ruby plugin if possible.

input {                                                                                                                 
  file {                                                                                                                
    codec => multiline {                                                                                                
      pattern => "<?xml"                                                                                                
      negate => "true"                                                                                                  
      what => "previous"                                                                                                
      auto_flush_interval => 1                                                                                          
    }                                                                                                                   
    path => "/Users/iwelch/Documents/logstash-6.2.4/ft-log-files/test.xml"                                              
    start_position => "beginning"                                                                                       
    sincedb_path => "/dev/null"                                                                                         
  }                                                                                                                     
}                                                                                                                       
                                                                                                                        
                                                                                                                        
filter {                                                                                                                
  xml {                                                                                                                 
    source => "message"                                                                                                 
    store_xml => true                                                                                                   
    target => "record"                                                                                                  
    xpath => ["/robot/metadata/item", "meta"]                                                                           
  }                                                                                                                     
                                                                                                                        
}                                                                                                                       
                                                                                                                        
output {                                                                                                                
  stdout { codec => rubydebug }                                                                                         
}

Cheers!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.