elasticsearch - 在Logstash中提取xpath值以有条件地创建新字段

Question

我的xml文件的结构附在下面。我想提取xpath创建的字段的值并对其运行if if条件。如果station_name的值等于“Finch”，则创建一个新字段并存储在其中。有人可以建议我如何实现这一目标

我要实现的目标的编纂版本

if "Finch" in [station_name] {
xpath => ["/station/name/text()","Ny_station"]
}
else {
xpath => ["/station/name/text()","nonNy_station"]
}

这是我的配置文件

input
{
file
{
path => "C:\Users\186181152\Downloads\stations3.xml"
start_position => "beginning"
sincedb_path => "/dev/null"
exclude => "*.gz"
type => "xml"
codec => multiline {
     pattern => "<stations>" 
     negate => "true"
     what => "previous"
}
}
}
filter
{
xml
{
source => "message"
store_xml => false
target => "stations"
xpath => [
"/stations/station/id/text()", "station_id",
"/stations/station/name/text()", "station_name"
]
}

}

output
{
elasticsearch
{
codec => json
hosts => "localhost"
index => "xmlns24"
}
stdout
{
codec => rubydebug
}

}

Answer 1

您不能在XML过滤器中使用if else循环。但是您可以有两个xml过滤器，并且可以在if else循环中使用，唯一的区别是xpath创建的变量。

在这里，它根据消息值检查字符串Finch作为正则表达式模式，以确定要使用哪个xml过滤器。

if [message] =~ "Finch" {
    xml
    {
        source => "message"
        store_xml => false
        target => "stations"
        xpath => [
            "/stations/station/id/text()", "station_id",
            "/stations/station/name/text()", "Ny_station"
        ]
    }
} else {
    {
        source => "message"
        store_xml => false
        target => "stations"
        xpath => [
            "/stations/station/id/text()", "station_id",
            "/stations/station/name/text()", "nonNy_station"
        ]
    }
}