Xpath filtering

Elastic Stack Logstash
1

I am parsing an xml file via logstash and in my xml structure I have few repeated tags as below :
<.....>
<.......>
<hard_request name="mem_avail" resource_contribution="0.000000">900G</hard_request>
<hard_request name="h_rt" resource_contribution="0.000000">518400</hard_request>
<......>
<.....>
For this I need the output as :
"hard_request" => [
[0] mem_avail = 900G
[1] h_rt = 518400
]

2 
    xml { source => "message" target => "[@metadata][theXML]" }
    ruby {
        code => '
            a = []
            event.get("[@metadata][theXML][hard_request]").each { |x|
                a << { x["name"] => x["content"] }
            }
            event.set("hard_request", a)
        '
    }

will get you

"hard_request" => [
    [0] {
        "mem_avail" => "900G"
    },
    [1] {
        "h_rt" => "518400"
    }
],
3

Thanks ! this works perfect.
What if I further want to store the "hard_request" in below format:
"hard_request" => mem_avail:900G, h_rt: 518400,......

I tried with "join" :
mutate { join => { "hard_request" => "," } }
but achieved below result:
"hard_request" => "{"mem_avail"=>"900G"},{"h_rt"=>"518400"}",

4

I do not know what you mean by this. Is it an array of strings, with the first string being "mem_avail:900G"?

5

Yes. basically I meant array elements concatenated into string with say "," separator.
First string can be anything depending upon what is at 0th index and "hard_request" tags could be 'n' number thus number of array elements can also vary in each event.

6

I am still not entirely clear what you want, but

    ruby {
        code => '
            s = ""
            event.get("[@metadata][theXML][hard_request]").each { |x|
                s = s + x["name"] +":" + x["content"] + ","
            }
            event.set("hard_request", s.chomp(","))
        '
    }

will get you

"hard_request" => "mem_avail:900G,h_rt:518400",
7

You nailed it ! This is exactly what I meant.
Thank you !

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.