I'm trying to process xml file to ES with Logstash. But I tried multiple times it's still not working. I highly appreciate your kind help. The configure file as following:
input {
file {
path => "/data/logstashtest/*.xml"
start_position => "beginning"
}
}
filter {
multiline {
pattern => "^\s|</report>|^[A-Za-z].*"
what => "previous"
}
xml {
store_xml => "false"
source => "message"
xpath => [
"/report/@logtype", "logtype",
"/report/result/@name", "name",
"/report/result/@start-epoch", "start-epoch",
"/report/result/@generated-at","generated-at"
]
}
date {
match => [ "generated-at", "ISO8601" ]
}
}
output {
elasticsearch {
protocol => http
host => localhost
port => 9200
cluster => mycluster
index => mylog
}
stdout { codec => rubydebug }
}
The xml source file as following:
<report reportname="" logtype="news">
<result name="financial news" logtype="news" start-epoch="1433134800" end-epoch="1433149199" generated-at="2015/06/01 04:10:17"/>
</report>
The Logstash is in the same node with one of ES nodes. I used the following command:
bin/logstash -f threatlog.conf
It output:
[2015-09-09 17:55:29.811] WARN -- Concurrent: [DEPRECATED] Java 7 is deprecated, please use Java 8.
Java 7 support is only best effort, it may not work. It will be removed in next release (1.0).
Logstash startup completed
When I check the ES index, there is nothing. I'm using logstash-1.5.4. Thanks in advance!