XML some similare tags generate row for each

Elastic Stack Logstash
1

Hello,

I try to extract datas from a XML like :

<?xml version="1.0" encoding="ISO-8859-1" standalone="yes"?>
<MASTER>
<CODE>ABC</CODE>
<ENTITE>FR</ENTITE>
<TYPEDEMANDE>prevision</TYPEDEMANDE>
<critere>
    <numero>field1</numero>
    <valeur>one</valeur>
  </critere>
  <critere>
    <numero>field2</numero>
    <valeur>two</valeur>
  </critere>
  <critere>
    <numero>field3</numero>
    <valeur>three</valeur>
  </critere>
  <critere>
    <numero>field4</numero>
    <valeur>four</valeur>
  </critere>
  <critere>
    <numero>field5</numero>
    <valeur>five</valeur>
  </critere>
</MASTER>

I use the XML filter and it works fine for the firsts three tag.
But I would create new field for each with as field name and as value for the field.

I try to use XPATH but it put all in only one field.

Actual xml filter :

xml {
          source => "request_service"
          store_xml => false
          xpath => ["//critere/*","datas"]
          add_field => { "%{numero}" => "%{valeur}"}
        }

Have you any idea to help me ?

Thanks in advance and have a nice day

2

You could try

    xml { source => "message" target => "[@metadata][theXML]" force_array => false }

    ruby {
        code => '
            event.get("[@metadata][theXML][critere]")&.each { |h|
                event.set(h["numero"], h["valeur"])
            }
        '
    }
3

Hello,

I have an error but it's because the "numero" could contain "[0]".

I try to use gsub inside the ruby code to substitute [0] by _0_ but I don't know where to put it.

I found the regex to use : \[\d\] and probably _\1_ for the remplacement.

I never code with Ruby.

Coudl you help me ?

5

If you are getting "Ruby exception occurred: Invalid FieldReference" because numero looks like "word[0]" then you can fix that by changing the event.set call

event.set(h["numero"].gsub(/[\[\]]/, "_"), h["valeur"])
6

Hi Badger

It seems to work fine for the critere part. I just continue to make some tests.
But now, I don't have the firsts tags before the critere.
I think I have to work with [@metadata][theXML] to get the missing tags.

Can you explain me the synthax : target => "[@metadata][theXML]

Hum hum sorry I just have to read the documentation.
https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html

Thanks in advance and for your precious help.