多行过滤器允许将xml文件创建为单个事件,我们可以使用xml过滤器或xpath解析xml以吸收elasticsearch中的数据。
在多行过滤器中,我们提到了logstash用来扫描xml文件的模式(在下面的示例中)。一旦模式匹配,之后的所有条目将被视为单个事件。
以下是我的数据的工作配置文件示例
input {
file {
path => "C:\Users\186181152\Downloads\stations3.xml"
start_position => "beginning"
sincedb_path => "/dev/null"
exclude => "*.gz"
type => "xml"
codec => multiline {
pattern => "<stations>"
negate => "true"
what => "previous"
}
}
}
filter {
xml {
source => "message"
store_xml => false
target => "stations"
xpath => [
"/stations/station/id/text()", "station_id",
"/stations/station/name/text()", "station_name"
]
}
}
output {
elasticsearch {
codec => json
hosts => "localhost"
index => "xmlns24"
}
stdout {
codec => rubydebug
}
}