Question

我必须解析一个XML文档（作为rabbitmq消息接收）但我希望根据一些过滤器获得更多信息。这是我的logstash的xml部分

if ([message] =~ /^</) {
  xml {
    ...
    xpath => [
      "/APIOS_MOM_EVENT/IDENT/NO_EMIARTE/text()", "NO_EMIARTE",
      "name(/APIOS_MOM_EVENT/DATA/APIOS_EXPORT/*[not(self::METADATA)])","MESSAGE_TYPE",
      "name(/APIOS_MOM_EVENT/DATA/*)","RECOMMENDATIONS",
      "/APIOS_MOM_EVENT/DATA/APIOS_EXPORT/METADATA/CODE_OFFRE_WEB/text()","OFFRE_WEB"
    ]
    target => "xml"
  }
  alter {
    condrewrite => [
      "MESSAGE_TYPE","","EDITO"         
    ]
    condrewriteother => [
      "RECOMMENDATIONS","RECOMMENDATIONS","MESSAGE_TYPE","RECOMMENDATIONS"
    ]
    condrewriteother => [
      "RECOMMENDATIONS","SCHEDULE","MESSAGE_TYPE","SCHEDULE"
    ]
    remove_field => [ "RECOMMENDATIONS" ]
  }
  if [MESSAGE_TYPE]=="SCHEDULE" {        
    xml{
      source => "message"
      store_xml => false
      xpath => [            
        "/APIOS_MOM_EVENT/DATA/SCHEDULE/DAY/@DATE","DAY"
      ]
      target => "xml"          
    }
  }
}

所以这里如果我有一个SCHEDULE MESSAGE_TYPE，我想添加一个过滤器来获得DAY，但这样做似乎相当复杂。我觉得我的if语句中没有MESSAGE_TYPE

在if [MESSAGE_TYPE]=="SCHEDULE" {

之前，这一切都很好

Answer 1

好的，我不知道它为什么不起作用，但下面的代码效果很好

...
remove_field => [ "RECOMMENDATIONS" ]
      }
      if [MESSAGE_TYPE]=="SCHEDULE" {
        xml{
          source => "message"
          store_xml => false
          xpath => [
            "/APIOS_MOM_EVENT/DATA/SCHEDULE/DAY/@DATE","DAY",
            "/APIOS_MOM_EVENT/DATA/SCHEDULE/DAY/ELEMENT/NO_EMIARTE/text()","NO_EMIARTE",
            "/APIOS_MOM_EVENT/DATA/SCHEDULE/DAY/ELEMENT/ID_PROG/text()","ID_PROG"
          ]
          target => "xml"
        }
      }

现在，新的领域在ES中得到了很好的实现。

如何为一个xml消息使用多个xml过滤器

1 个答案: