XML to JSON and parsing the last one

Elastic Stack Logstash
1

If I am correct, after the xml filter the field invoice contains JSON.

xml {
		source => "documentout"
		target => "invoice"
	}

I did confirm this in the stdout

"invoice" => {
                         "DeliveryDate" => [
            [0] "2018-07-04"
        ],
                    "BuyersOrderNumber" => [
            [0] "1823934"
        ],
                        "InvoiceTotals" => [
            [0] {
                                 "TotalInvoiceAmount" => [
                    [0] "3500.84"
                ],
                                     "TotalVATAmount" => [
                    [0] "607.58"

No I wold like to use the value of "BuyersOrderNumber" out of the new JSON to look something up in an external database. The first question is, how do I query the newly gotten JSON for the value of that field?

2

I have been trying to use xpath on the xml but that just doesn't give any result. Even the remove_namespaces => true has no effect on the output JSon.

This is the debug-info concerning the xml filter. It doesn't even mention the missing actions:

[2018-08-31T10:50:02,544][DEBUG][logstash.config.source.local.configpathloader] Reading config file {:config_file=>"XXXXXXXXXXXXX.conf"}
[2018-08-31T10:50:02,550][DEBUG][logstash.agent           ] Converging pipelines state {:actions_count=>0}
[2018-08-31T10:50:02,661][DEBUG][logstash.filters.xml     ] Event after xml filter {:event=>#<LogStash::Event:0x51820632>}
[2018-08-31T10:50:02,661][DEBUG][logstash.filters.xml     ] Event after xml filter {:event=>#<LogStash::Event:0x328b2f33>}
[2018-08-31T10:50:02,663][DEBUG][logstash.filters.xml     ] Running xml filter {:event=>#<LogStash::Event:0x10d3ecdf>}
[2018-08-31T10:50:02,672][DEBUG][logstash.filters.mutate  ] filters/LogStash::Filters::Mutate: removing field {:field=>"documentsigned"}
[2018-08-31T10:50:02,673][DEBUG][logstash.filters.mutate  ] filters/LogStash::Filters::Mutate: removing field {:field=>"documentout"}
[2018-08-31T10:50:02,677][DEBUG][logstash.filters.xml     ] Event after xml filter {:event=>#<LogStash::Event:0x6980aa5e>}
[2018-08-31T10:50:02,677][DEBUG][logstash.filters.mutate  ] filters/LogStash::Filters::Mutate: removing field {:field=>"documentsigned"}
[2018-08-31T10:50:02,678][DEBUG][logstash.filters.mutate  ] filters/LogStash::Filters::Mutate: removing field {:field=>"documentout"}
[2018-08-31T10:50:02,679][DEBUG][logstash.pipeline        ] output received {"event"=>{"@version"=>"1", "invoice"=>{"xmlns:ic"=>"
3

If I am correct, after the xml filter the field invoice contains JSON.

No, JSON is a string representation of structured data. After the xml filter you have structured data, not its string representation.

No I wold like to use the value of "BuyersOrderNumber" out of the new JSON to look something up in an external database. The first question is, how do I query the newly gotten JSON for the value of that field?

[invoice][BuyersOrderNumber][0]

4

Thanks Magnus,

i got it working!