Ошибка Logstash: анализ XML-файла

Я новичок в ELK, и мне нужна ваша помощь. Я хотел бы получить некоторую информацию о процессоре, памяти. Эти информативные данные генерируются каждые 30 минут.

Мой XML-файл

<?xml version="1.0" encoding="UTF-8"?>
<measData>
<measInfo Id="SensorProcessingCounters">
<measType p="1">SensorsProcessed</measType>
<measValue xxxxxxxxx >
<r p="1">81</r>
</measValue>
</measInfo>
</measData>

Мой logstash file.conf

input {
  file {
    path => "/home/test/Desktop/data/file.xml"
    start_position => beginning
    sincedb_path => "/dev/null"
    codec => multiline
  {
   pattern => "<measData>|</measData>"
   negate => true
   what => "previous"
  }
 }
}
filter
{
xml {
store_xml => false
source => "message"
xpath =>
["//measInfo[@measInfoId="SensorProcessingCounters"]/measValue/r[@p='1']/text()", "SensorProcessingCounters"
]
}
mutate{
convert => {
"SensorProcessingCounters"=> "float"}
}
}
output{
  elasticsearch
    {
        action => "index"
        hosts => ["localhost:9200"]
        index => "stock"
    }
    stdout{}
}

сообщение об ошибке

[2018-07-12T11:16:19,253][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-07-12T11:16:19,973][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.3.1"}
[2018-07-12T11:16:20,649][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, ,, ] at line 20, column 27 (byte 432) after filter
{
xml {
store_xml => false
source => "message"
xpath =>
["//measInfo[@measInfoId="", :backtrace=>["/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]}
[2018-07-12T11:16:21,024][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

спасибо

elasticsearch,logstash,kibana,

1

Ответов: 1


Мой logstash file.conf

input {
  file {
    path => "/home/test/Desktop/data/file.xml"
    start_position => beginning
    sincedb_path => "/dev/null"
    codec => multiline
  {
   pattern => "<measData>|</measData>"
   negate => true
   what => "previous"
  }
 }
}
filter
{
xml {
store_xml => false
source => "message"
xpath =>
["//measInfo[@measInfoId="SensorProcessingCounters"]/measValue/r[@p='1']/text()", "SensorProcessingCounters"
]
}
mutate{
convert => {
"SensorProcessingCounters"=> "float"}
}
}
output{
  elasticsearch
    {
        action => "index"
        hosts => ["localhost:9200"]
        index => "stock"
    }
    stdout{}
}

сообщение об ошибке

[2018-07-12T11:16:19,253][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-07-12T11:16:19,973][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.3.1"}
[2018-07-12T11:16:20,649][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, ,, ] at line 20, column 27 (byte 432) after filter
{
xml {
store_xml => false
source => "message"
xpath =>
["//measInfo[@measInfoId="", :backtrace=>["/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/home/test/Desktop/logstash-6.3.1/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]}
[2018-07-12T11:16:21,024][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

спасибо

11
1 принят

Для этой строки:

["// measInfo [@ measInfoId =" SensorProcessingCounters "] / measValue / r [@ p = '1'] / text ()", "SensorProcessingCounters"

Я думаю, вы должны использовать одинарные кавычки:

["// measInfo [@ measInfoId = 'SensorProcessingCounters'] / measValue / r [@ p = '1'] / text ()", "SensorProcessingCounters"

потому что несоответствие цитат.

elasticsearch, logstash, kibana,
Похожие вопросы
Яндекс.Метрика