logstash 解析 xml

读取日志<ROOT number="34"><EVENTLIST><EVENT name="hey"/><EVENT name="you"/></EVENTLIST></ROOT>
只是一行日志


在filter中
filter {
  else if [path] =~ /xml/ {
xml {
source => "message"
target =>"doc"
xpath => [
"/ROOT/@number","number",
"/ROOT/EVENTLIST/EVENT/@name","EVENT"
]
}
  }
}


在进入es后
{
  "_source": {
    "message": "<ROOT number="34"><EVENTLIST><EVENT name="hey"/><EVENT name="you"/></EVENTLIST></ROOT>",
    "@version": "1",
    "@timestamp": "2015-03-16T16:06:44.531+08:00",
    "@time": "16:06:44",
    "host": "123",
    "number": [
      "34"
    ],
    "EVENT": [
      "hey",
      "you"
    ],
    "doc": {
      "number": "34",
      "EVENTLIST": [
        {
          "EVENT": [
            {
              "name": "hey"
            },
            {
              "name": "you"
            }
          ]
        }
      ]
    }
  }
}