Logstash学习21_Logstash 解析 XML

读取日志
只是一行日志

在filter中
filter {
  else if [path] =~ /xml/ {
xml {
source => "message"
target =>"doc"
xpath => [
"/ROOT/@number","number",
"/ROOT/EVENTLIST/EVENT/@name","EVENT"
]
}
  }
}


在进入es后
{
  "_source": {
    "message": "",
    "@version": "1",
    "@timestamp": "2015-03-16T16:06:44.531+08:00",
    "@time": "16:06:44",
    "host": "123",
    "number": [
      "34"
    ],
    "EVENT": [
      "hey",
      "you"
    ],
    "doc": {
      "number": "34",
      "EVENTLIST": [
        {
          "EVENT": [
            {
              "name": "hey"
            },
            {
              "name": "you"
            }
          ]
        }
      ]
    }
  }
}

原文来自：http://blog.csdn.net/z3636081/article/details/62887509