I have to parse an XML document (received as a rabbitmq message) but I want to get some more info according some filters. Here the xml part of my logstash
if ([message] =~ /^</) { xml { ... xpath => [ "/APIOS_MOM_EVENT/IDENT/NO_EMIARTE/text()", "NO_EMIARTE", "name(/APIOS_MOM_EVENT/DATA/APIOS_EXPORT/*[not(self::METADATA)])","MESSAGE_TYPE", "name(/APIOS_MOM_EVENT/DATA/*)","RECOMMENDATIONS", "/APIOS_MOM_EVENT/DATA/APIOS_EXPORT/METADATA/CODE_OFFRE_WEB/text()","OFFRE_WEB" ] target => "xml" } alter { condrewrite => [ "MESSAGE_TYPE","","EDITO" ] condrewriteother => [ "RECOMMENDATIONS","RECOMMENDATIONS","MESSAGE_TYPE","RECOMMENDATIONS" ] condrewriteother => [ "RECOMMENDATIONS","SCHEDULE","MESSAGE_TYPE","SCHEDULE" ] remove_field => [ "RECOMMENDATIONS" ] } if [MESSAGE_TYPE]=="SCHEDULE" { xml{ source => "message" store_xml => false xpath => [ "/APIOS_MOM_EVENT/DATA/SCHEDULE/DAY/@DATE","DAY" ] target => "xml" } } }
So here if I have a SCHEDULE MESSAGE_TYPE I would like to add a filter to get the DAY but it seems quite complex to do so. I have the feeling that MESSAGE_TYPE is not available in my if statement
It's all good until if [MESSAGE_TYPE]=="SCHEDULE" {
No comments:
Post a Comment