Logstash编解码器多行模式

Question

我有XML

    <test-suite type="TestFixture" name="RegionalityFeature" description="Regionality" executed="True" result="Failure" success="False" time="64.162" asserts="3">
    <properties>
        <property name="Description" value="Regionality" />
    </properties>
    <failure>
        <message><![CDATA[One or more child tests had errors]]></message>
        <stack-trace />
    </failure>
    <results>
        <test-suite type="ParameterizedTest" name="_10CorrectRegionSwitchoverWithAuthorization" description="#10 Correct region switchover with authorization" executed="True" result="Failure" success="False" time="39.907" asserts="2">
            <categories>
                <category name="*Page" />
                <category name="LoginPage" />
                <category name="ErrorPage" />
            </categories>
            <properties>
                <property name="Description" value="#10 Correct region switchover with authorization" />
            </properties>
            <failure>
                <message><![CDATA[One or more child tests had errors]]></message>
                <stack-trace />
            </failure>
            <results>
                <test-case name="QA.*.Tests.Features.Regionality.RegionalityFeature._10CorrectRegionSwitchoverWithAuthorization(&quot;*&quot;,&quot;*&quot;,&quot;moskva&quot;,&quot;/login/?returnUrl=https:*/&quot;,&quot;spb&quot;,&quot;*бург&quot;,&quot;/customers/products/&quot;,System.String[])" executed="True" result="Failure" success="False" time="39.904" asserts="2">
                    <failure>
                        <message><![CDATA[  User is not authorized
  Expected: not null and not <empty>
  But was:  <string.Empty>
]]></message>
                        <stack-trace><![CDATA[в QA.*.Tests.Steps.Pages.*PageSteps.PageIsAuthorizedWithUser(String login) в c:\AutoTest3\source\QA.*.Tests\QA.*.Tests\Steps\Pages\*PageSteps.cs:строка 59
в TechTalk.SpecFlow.Bindings.BindingInvoker.InvokeBinding(IBinding binding, IContextManager contextManager, Object[] arguments, ITestTracer testTracer, TimeSpan& duration)
в TechTalk.SpecFlow.Infrastructure.TestExecutionEngine.ExecuteStepMatch(BindingMatch match, Object[] arguments)
в TechTalk.SpecFlow.Infrastructure.TestExecutionEngine.ExecuteStep(StepInstance stepInstance)
в TechTalk.SpecFlow.Infrastructure.TestExecutionEngine.OnAfterLastStep()
в QA.*.Tests.Features.Regionality.RegionalityFeature._10CorrectRegionSwitchoverWithAuthorization(String login, String password, String region, String loginUrl, String newRegion, String newRegionTitle, String expectedUrl, String[] exampleTags) в c:\AutoTest3\source\QA.*.Tests\QA.*.Tests\Features\Regionality\Regionality.feature:строка 26
]]></stack-trace>
                    </failure>
                </test-case>
            </results>
        </test-suite>
        <test-suite type="ParameterizedTest" name="_9CorrectRegionSwitchover" description="#9 Correct region switchover" executed="True" result="Success" success="True" time="24.251" asserts="1">
            <categories>
                <category name="*Page" />
                <category name="ErrorPage" />
            </categories>
            <properties>
                <property name="Description" value="#9 Correct region switchover" />
            </properties>
            <results>
                <test-case name="QA.*.Tests.Features.Regionality.RegionalityFeature._9CorrectRegionSwitchover(&quot;moskva&quot;,&quot;/cu*/&quot;,&quot;spb&quot;,&quot;Санкт-Петербург&quot;,System.String[])" executed="True" result="Success" success="True" time="24.249" asserts="1" />
            </results>
        </test-suite>
    </results>
</test-suite>

有必要将其更改为json，以便将其放入elasticsearch中。为此，我选择了Logstash，我的配置如下所示：

input {
  file {
    path => "C:\AutoTest3\report\test.xml"
    start_position => "beginning"
    sincedb_path => "NUL"
 codec => multiline {
  pattern => "</test-suite>"
  negate => true
  what => "previous"
      auto_flush_interval => 1
    }
  }
}

filter {
  xml {
    source => "message"
    target => "message.parsed"
    xpath => [
                "/test-suite/results/test-suite/@name", name,
                "/test-suite/results/test-suite/@success", success
            ]
    force_array => false
  }
    mutate {
        remove_field => [ "path","@timestamp","host","tags","@version"]
    }

}

output {
file { 
codec => "json"
path => ["C:/Logstash/temp.json"]
}
}

在这个XML中，我需要创建一个包含两个条目的json :名称success

{
    "success": ["False"],
    "name": ["_10CorrectRegionSwitchoverWithAuthorization"]
}
{
    "success": ["True"],
    "name": ["_9CorrectRegionSwitchover"]
}

但是我不能理解如何用多行编写模式(导航哪个元素)，这样logstash才能理解我这里有两个事件。

Answer 1

以下是解决方案

input {
  file {
    path => "C:\AutoTest3\report\test.xml"
    start_position => "beginning"
    sincedb_path => "NUL"
 codec => multiline {
  pattern => "<test-suite type="
  negate => true
  what => "previous"
      auto_flush_interval => 1
    }
  }
}

filter {
  xml {
    source => "message"
    target => "message.parsed"
    xpath => [
                "/test-suite/@success", success,
                "/test-suite/@name", name,
                "/test-suite/@time", time,
                "/test-suite/@description", description,
                "/test-suite/results/test-suite/results/test-case/failure/message/text()", "message"
            ]
    force_array => false
  }
    mutate {
        remove_field => [ "path","@timestamp","host","tags","@version","message","message.parsed"]
    }

}

output {
file { 
codec => "json"
path => ["C:/Logstash/temp.json"]
}
}