logstash 解析 xml

2018-02-05 10:29:45来源:oschina作者:诺岚人点击

分享

源文件:


<?xml version="1.0" encoding="UTF-8"?>










解析配置如下:


input {
stdin{ }
}
#解析文件
filter {
xml {
remove_namespaces=>"true"
source => "message"
target =>"doc"
xpath => [
"/IPC2547Event/ItemProcessStatus/@dateTime","dateTime",
"/IPC2547Event/ItemProcessStatus/@itemInstanceId","itemInstanceId",
"/IPC2547Event/ItemProcessStatus/@sessionRef","sessionRef",
"/IPC2547Event/ItemProcessStatus/@itemProcessId","itemProcessId",
"/IPC2547Event/ItemProcessStatus/@status","status","/IPC2547Event/ItemProcessStatus/ItemEventCount/@eventType","eventType",
"/IPC2547Event/ItemProcessStatus/ItemEventCount/@count","count",
"/IPC2547Event/ProcessStepStatus[1]/@dateTime","dateTime",
"/IPC2547Event/ProcessStepStatus[1]/@itemInstanceId","itemInstanceId",
"/IPC2547Event/ProcessStepStatus[1]/@sessionRef","sessionRef",
"/IPC2547Event/ProcessStepStatus[1]/@itemProcessRef","itemProcessRef",
"/IPC2547Event/ProcessStepStatus[1]/@processStepId","processStepId",
"/IPC2547Event/ProcessStepStatus[1]/@status","status",
"/IPC2547Event/ProcessStepStatus[1]/@imageId","imageId",
"/IPC2547Event/ProcessStepStatus[2]/@dateTime","dateTime",
"/IPC2547Event/ProcessStepStatus[2]/@itemInstanceId","itemInstanceId",
"/IPC2547Event/ProcessStepStatus[2]/@sessionRef","sessionRef",
"/IPC2547Event/ProcessStepStatus[2]/@itemProcessRef","itemProcessRef",
"/IPC2547Event/ProcessStepStatus[2]/@processStepId","processStepId",
"/IPC2547Event/ProcessStepStatus[2]/@status","status",
"/IPC2547Event/ProcessStepStatus[2]/@imageId","imageId"
]
}
}
output {
stdout{
codec=>rubydebug
}
}

往ES中写入数据:


filter {
xml {
remove_namespaces=>"true"
source => "message"
target =>"doc"
xpath => [
"/IPC2547Event/ItemProcessStatus/@dateTime","dateTime",
"/IPC2547Event/ItemProcessStatus/@itemInstanceId","itemInstanceId",
"/IPC2547Event/ItemProcessStatus/@sessionRef","sessionRef",
"/IPC2547Event/ItemProcessStatus/@itemProcessId","itemProcessId",
"/IPC2547Event/ItemProcessStatus/@status","status","/IPC2547Event/ItemProcessStatus/ItemEventCount/@eventType","eventType",
"/IPC2547Event/ItemProcessStatus/ItemEventCount/@count","count",
"/IPC2547Event/ProcessStepStatus[1]/@dateTime","dateTime",
"/IPC2547Event/ProcessStepStatus[1]/@itemInstanceId","itemInstanceId",
"/IPC2547Event/ProcessStepStatus[1]/@sessionRef","sessionRef",
"/IPC2547Event/ProcessStepStatus[1]/@itemProcessRef","itemProcessRef",
"/IPC2547Event/ProcessStepStatus[1]/@processStepId","processStepId",
"/IPC2547Event/ProcessStepStatus[1]/@status","status",
"/IPC2547Event/ProcessStepStatus[1]/@imageId","imageId",
"/IPC2547Event/ProcessStepStatus[2]/@dateTime","dateTime",
"/IPC2547Event/ProcessStepStatus[2]/@itemInstanceId","itemInstanceId",
"/IPC2547Event/ProcessStepStatus[2]/@sessionRef","sessionRef",
"/IPC2547Event/ProcessStepStatus[2]/@itemProcessRef","itemProcessRef",
"/IPC2547Event/ProcessStepStatus[2]/@processStepId","processStepId",
"/IPC2547Event/ProcessStepStatus[2]/@status","status",
"/IPC2547Event/ProcessStepStatus[2]/@imageId","imageId"
]
}
}
output {
elasticsearch {
index => "log-%{+YYYY.MM.dd}"
hosts => ["10.2.1.238:9200", "10.2.1.237:9200", "10.2.1.241:9200"]
}
stdout{
codec=>rubydebug
}
}

解析结果:


{
"@version" => "1",
"host" => "localhost.localdomain",
"@timestamp" => 2018-02-02T06:38:24.163Z,
"message" => "<?xml version=/"1.0/" encoding=/"UTF-8/"?>",
"tags" => [
[0] "_xmlparsefailure"
]
}
{
"dateTime" => [
[0] "2017-09-07T11:37:23.00+08:00",
[1] "2017-09-07T11:37:23.00+08:00",
[2] "2017-09-07T11:37:23.00+08:00"
],
"itemInstanceId" => [
[0] "20200008618100004",
[1] "20200008618100004",
[2] "20200008618100004"
],
"imageId" => [
[0] "1",
[1] "2"
],
"count" => [
[0] "2"
],
"eventType" => [
[0] "PROCESSSTEPSTATUS"
],
"message" => "",
"sessionRef" => [
[0] "S_20200008618100004_1504755459",
[1] "S_20200008618100004_1504755459",
[2] "S_20200008618100004_1504755459"
],
"processStepId" => [
[0] "20200008618100004_1",
[1] "20200008618100003"
],
"@timestamp" => 2018-02-02T06:38:24.166Z,
"@version" => "1",
"host" => "localhost.localdomain",
"doc" => {
"ItemProcessStatus" => [
[0] {
"dateTime" => "2017-09-07T11:37:23.00+08:00",
"sessionRef" => "S_20200008618100004_1504755459",
"itemInstanceId" => "20200008618100004",
"itemProcessId" => "20200008618100004_1504755459",
"ItemEventCount" => [
[0] {
"count" => "2",
"eventType" => "PROCESSSTEPSTATUS"
}
],
"status" => "PASSED"
}
],
"ProcessSessionStart" => [
[0] {
"dateTime" => "2017-09-07T11:37:23.00+08:00",
"Product" => [
[0] {
"itemType" => "852RN5691MB2003"
}
],
"Entity" => [
[0] {
"stage" => "AOI",
"stationId" => "TBA7150495"
}
],
"sessionId" => "S_20200008618100004_1504755459",
"Recipe" => [
[0] {
"RecipeModule" => [
[0] {
"moduleId" => "456.bib",
"revision" => "2017-09-07T10:48:48.00+08:00"
}
],
"recipeId" => "852RN5691MB2003.tst",
"revision" => "2017-09-07T09:42:35.00+08:00"
}
]
}
],
"ProcessStepStatus" => [
[0] {
"dateTime" => "2017-09-07T11:37:23.00+08:00",
"sessionRef" => "S_20200008618100004_1504755459",
"processStepId" => "20200008618100004_1",
"itemInstanceId" => "20200008618100004",
"imageId" => "1",
"itemProcessRef" => "20200008618100004_1504755459",
"status" => "PASSED"
},
[1] {
"dateTime" => "2017-09-07T11:37:23.00+08:00",
"sessionRef" => "S_20200008618100004_1504755459",
"processStepId" => "20200008618100003",
"itemInstanceId" => "20200008618100004",
"imageId" => "2",
"itemProcessRef" => "20200008618100004_1504755459",
"status" => "PASSED"
}
]
},
"itemProcessId" => [
[0] "20200008618100004_1504755459"
],
"status" => [
[0] "PASSED",
[1] "PASSED",
[2] "PASSED"
],
"itemProcessRef" => [
[0] "20200008618100004_1504755459",
[1] "20200008618100004_1504755459"
]
}

最新文章

123

最新摄影

闪念基因

微信扫一扫

第七城市微信公众平台