elasticsearch - Logstash错误:解析xml文件

Question

我是ELK的新手，需要您的帮助。
我想获取有关CPU，内存的一些信息。这些信息每30分钟产生一次。

我的xml文件

<?xml version="1.0" encoding="UTF-8"?>
<measData>
<measInfo Id="SensorProcessingCounters">
<measType p="1">SensorsProcessed</measType>
<measValue xxxxxxxxx >
<r p="1">81</r>
</measValue>
</measInfo>
</measData>

我的logstash file.conf

input {
  file {
    path => "/home/test/Desktop/data/file.xml"
    start_position => beginning
    sincedb_path => "/dev/null"
    codec => multiline
  {
   pattern => "<measData>|</measData>"
   negate => true
   what => "previous"
  }
 }
}
filter
{
xml {
store_xml => false
source => "message"
xpath =>
["//measInfo[@measInfoId="SensorProcessingCounters"]/measValue/r[@p='1']/text()", "SensorProcessingCounters"
]
}
mutate{
convert => {
"SensorProcessingCounters"=> "float"}
}
}
output{
  elasticsearch
    {
        action => "index"
        hosts => ["localhost:9200"]
        index => "stock"
    }
    stdout{}
}

错误信息

[2018-07-12T11:16:19,253][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-07-12T11:16:19,973][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.3.1"}
[2018-07-12T11:16:20,649][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, ,, ] at line 20, column 27 (byte 432) after filter\r\n{\r\nxml {\r\nstore_xml => false\r\nsource => \"message\"\r\nxpath =>\r\n[\"//measInfo[@measInfoId=\"", :backtrace=>["/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]}
[2018-07-12T11:16:21,024][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

谢谢

Answer 1

对于此行:

["//measInfo[@measInfoId="SensorProcessingCounters"]/measValue/r[@p='1']/text()", "SensorProcessingCounters"

我想您应该使用单引号:

["//measInfo[@measInfoId='SensorProcessingCounters']/measValue/r[@p='1']/text()", "SensorProcessingCounters"

因为报价不匹配。