elasticsearch Logstash-从xml文件创建多个事件,elasticsearch,logstash,elasticsearch,Logstash" /> elasticsearch Logstash-从xml文件创建多个事件,elasticsearch,logstash,elasticsearch,Logstash" />

elasticsearch Logstash-从xml文件创建多个事件

elasticsearch Logstash-从xml文件创建多个事件,elasticsearch,logstash,elasticsearch,Logstash,我希望基于and将xml元素解析为多个事件,但在解析时,它是作为一个带有值数组的单个事件给出的 示例XML: * * Logstash confg * 但我得到的输出为 { "Info1":"ABC", "Info2":"123", "data.text":[ [0] "T1", [1] "T2", [2] "T3"], "data.value":[ [0] "V1", [1] "V2

我希望基于and将xml元素解析为多个事件,但在解析时,它是作为一个带有值数组的单个事件给出的

示例XML: *

*

Logstash confg

*

但我得到的输出为

{
    "Info1":"ABC",
    "Info2":"123",
    "data.text":[
        [0] "T1",
        [1] "T2",
        [2] "T3"],
    "data.value":[
        [0] "V1",
        [1] "V2",
        [2] "V3"]
}
请帮助我如何编写正确的xpath过滤器,以便根据我的要求对其进行解析


提前谢谢。

看起来和你的很相似,并且有答案。也许会有帮助。我认为
Val
提供的答案对您更有帮助。。。看起来很像你的,有答案。也许会有帮助。我认为
Val
提供的答案对您更有帮助。。。
{
    "Info1":"ABC",
    "Info2":"123",
    "data.text":"T1",
    "data.value":"V1",
},
{
    "Info1":"ABC",
    "Info2":"123",
    "data.text":"T2",
    "data.value":"V2",
},
{
    "Info1":"ABC",
    "Info2":"123",
    "data.text":"T3",
    "data.value":"V3",
}
input {
  stdin { }
}
filter {
  xml {
    source => "message"
    store_xml => false 
        xpath => [
            "//Header/Info1/text()","Info1",
            "//Header/Info2/text()","Info2",
            "//DataArea/Data/Text/text()","data.text",
            "//DataArea/Data/Value/text()","data.value"
            ]
        }
  }
}
output { elasticsearch { host => localhost } stdout { codec => rubydebug } }
{
    "Info1":"ABC",
    "Info2":"123",
    "data.text":[
        [0] "T1",
        [1] "T2",
        [2] "T3"],
    "data.value":[
        [0] "V1",
        [1] "V2",
        [2] "V3"]
}