我最近开始学习elk,但在理解如何解析XML数据方面遇到了困难。
我想分析我的XML文件,它如下所示:
<Name nameID="xxxx">
<Type p="1">xxxxxx</Type>
<Type p="2">xxxxxx</Type>
.
.
<Type p="9">xxxxx</Type>
<Value obj="1">
<r p="1">5.94</r>
<r p="2">62.19</r>
.
.
<r p="9">7.19</r>
</Value>
<Value obj="2">
<r p="1">5.94</r>
<r p="2">62.19</r>
.
.
<r p="9">7.19</r>
</Value>
</Name>
<Name nameID="yyyy">
<Type p="1">yyyyy</Type>
<Type p="2">yyyyyy</Type>
<Type p="3">yyyy</Type>
<Value obj="1">
<r p="1">54.94</r>
<r p="2">6.19</r>
<r p="3">0</r>
</Value>
</Name>
我想得到这样的结果:在输出中
"NameID = name1
Type = Type1
obj = obj1
Value = xx
"
"NameID = name1
Type = Type2
obj = obj1
Value = xx
"
"NameID = name1
Type = Type3
obj = obj1
Value = xx
"
...etc
and then
"NameID = name1
Type = Type1
obj = obj2
Value = xx
"
"NameID = name1
Type = Type2
obj = obj2
Value = xx
"
....etc
我使用了这个logstash.conf,但是我没有得到我真正需要的(我为每个字段都得到一个数组)
input {
file {
path => "/home/test/data.xml"
start_position => beginning
sincedb_path => "/dev/null"
codec => multiline
{
pattern => "<Name"
negate => true
what => "previous"
}
}
}
filter
{
xml {
source => "message"
target => "parsed"
add_tag => "xml"
xpath => [
"//Name/@nameID","Name",
"//Type/@p","TypeID",
"//Type/text()","Type",
"//Value/@obj","Obj",
"//r/text()","value"]