elasticsearch Logstash-从xml文件创建多个事件
我希望基于and将xml元素解析为多个事件,但在解析时,它是作为一个带有值数组的单个事件给出的 示例XML: * * Logstash confg * 但我得到的输出为elasticsearch Logstash-从xml文件创建多个事件,elasticsearch,logstash,elasticsearch,Logstash,我希望基于and将xml元素解析为多个事件,但在解析时,它是作为一个带有值数组的单个事件给出的 示例XML: * * Logstash confg * 但我得到的输出为 { "Info1":"ABC", "Info2":"123", "data.text":[ [0] "T1", [1] "T2", [2] "T3"], "data.value":[ [0] "V1", [1] "V2
{
"Info1":"ABC",
"Info2":"123",
"data.text":[
[0] "T1",
[1] "T2",
[2] "T3"],
"data.value":[
[0] "V1",
[1] "V2",
[2] "V3"]
}
请帮助我如何编写正确的xpath过滤器,以便根据我的要求对其进行解析
提前谢谢。看起来和你的很相似,并且有答案。也许会有帮助。我认为
Val
提供的答案对您更有帮助。。。看起来很像你的,有答案。也许会有帮助。我认为Val
提供的答案对您更有帮助。。。
{
"Info1":"ABC",
"Info2":"123",
"data.text":"T1",
"data.value":"V1",
},
{
"Info1":"ABC",
"Info2":"123",
"data.text":"T2",
"data.value":"V2",
},
{
"Info1":"ABC",
"Info2":"123",
"data.text":"T3",
"data.value":"V3",
}
input {
stdin { }
}
filter {
xml {
source => "message"
store_xml => false
xpath => [
"//Header/Info1/text()","Info1",
"//Header/Info2/text()","Info2",
"//DataArea/Data/Text/text()","data.text",
"//DataArea/Data/Value/text()","data.value"
]
}
}
}
output { elasticsearch { host => localhost } stdout { codec => rubydebug } }
{
"Info1":"ABC",
"Info2":"123",
"data.text":[
[0] "T1",
[1] "T2",
[2] "T3"],
"data.value":[
[0] "V1",
[1] "V2",
[2] "V3"]
}