Logstash 错误：代理无法执行操作答案

【问题标题】：Logstash Error: agent failed to execute actionLogstash 错误：代理无法执行操作
【发布时间】：2022-01-18 15:43:54
【问题描述】：

XML 示例：

<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
   <soap:Header>
      <Header xmlns="https://kjkjj.com/kkkk" xmlns:ns2="https://sih.sadad.com/common">
         <ns2:RequestID>1a7f81ac-355f-11ec-bc47-3b3678cb106a</ns2:RequestID>
      </Header>
   </soap:Header>
   <soap:Body>
      <PaymentValidationResponse xmlns="https://######.com" xmlns:ns2="https://s/###/##">
         <StatusCode>0</StatusCode>
         <StatusDescription>Success</StatusDescription>
         <PaymentValidations>
            <PaymentValidation>
               <InvoiceCode>175810975800</InvoiceCode>
               <SupplierID>649</SupplierID>
               <SupplierName>MED</SupplierName>
               <Amount>2552.23</Amount>
               <StatusCode>0</StatusCode>
            </PaymentValidation>
         </PaymentValidations>
      </PaymentValidationResponse>
   </soap:Body>
</soap:Envelope>

我想使用 XPATH 解析 XML 字段，但执行此过滤器时出错，我不明白出了什么问题。

谢谢。

【问题讨论】：

标签： elasticsearch logstash logstash-configuration

【解决方案1】：

过滤器插件配置：

filter {
     
     multiline {
         pattern =>  "<soap:Body>"
         what => "previous"
         negate => "true"
     }
     xml {
        source => "message"
        store_xml => false
        remove_namespaces => true
     
        xpath => [
            "/soap:Envelope/soap:Header/Header/RequestID/text()", "RequestID",
            "/soap:Envelope/soap:Body/PaymentValidationResponse/StatusDescription/text()", "StatusDescription",
            "/soap:Envelope/soap:Body/PaymentValidationResponse/PaymentValidations/PaymentValidation/InvoiceCode/text()", "InvoiceCode",
            "/soap:Envelope/soap:Body/PaymentValidationResponse/PaymentValidations/PaymentValidation/SupplierID/text()", "SupplierID",
            "/soap:Envelope/soap:Body/PaymentValidationResponse/PaymentValidations/PaymentValidation/SupplierName/text()", "SupplierName",
            "/soap:Envelope/soap:Body/PaymentValidationResponse/PaymentValidations/PaymentValidation/Amount/text()", "Amount",
            "/soap:Envelope/soap:Body/PaymentValidationResponse/PaymentValidations/PaymentValidation/StatusCode/text()", "StatusCode",
            "/soap:Envelope/soap:Body/PaymentValidationResponse/PaymentValidations/PaymentValidation/ErrorMessage/text()", "ErrorMessage"
        ]
     }
     
     mutate {
              add_field => ["StatusDescription", "%{StatusDescription}"]
              #add_field => ["NameIndexed", "%{Name}"]
            }     
}

【讨论】：