我有下面的xml格式的日志文件
<QuerySiteInformation>
xmlns="http://www.example.com"
<Site>
<id>abc-cde-fvvvv</id>
<Item>
<id>e5753ead-d202-451e-92cc-ea49d0a6bdf5</id>
<code>67448833344443</code>
<objectMessage>Internal> message shown here in multiple lines</objectMessage>
<reference>/</reference>
</Item>
</Site>
<SiteInteraction>
<InteractionItem>
<Location>
<id>8496940--2842047577555</id>
<objectMessage>Internal> message shown here in multiple lines</objectMessage>
</Location>
</InteractionItem>
</SiteInteraction>
</QuerySiteInformation>
我只想在<objectMessage>
标记位于<Item>
标记内时将xml标记<objectMessage>message in multiples lines</objectMessage>
变更为<objectMessage>MESSAGE HAS BEEN REMOVED</objectMessage>
我有下面的配置部分,它可以查看并将xml转换为我想要的消息
<objectMessage>Internal> message shown here in multiple lines</objectMessage>
组态
filter {
mutate {
gsub => [
"some regex pattern can do the xml tag filtering", "MESSAGE HAS BEEN REMOVED"
]
}
}
但是,这将更改所有<objectMessage> message shown here in multiple lines</objectMessage>
,包括<Item>
字段之外的<objectMessage> message shown here in multiple lines</objectMessage>
我知道使用ruby插件可以做得更好,不应该使用regex进行xml解析。但这是目前为止我能找到的最接近的插件。
1条答案
按热度按时间cygmwpex1#
理想情况下,您希望使用内置的xml过滤器插件,它是更可靠和可维护的方式:
https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html
以下conf文件将解析XML并替换内部对象的值:
输出量: