Logstash編解碼器多模式

Question

我有XML

<test-suite type="TestFixture" name="RegionalityFeature" description="Regionality" executed="True" result="Failure" success="False" time="64.162" asserts="3"> 
    <properties> 
     <property name="Description" value="Regionality" /> 
    </properties> 
    <failure> 
     <message><![CDATA[One or more child tests had errors]]></message> 
     <stack-trace /> 
    </failure> 
    <results> 
     <test-suite type="ParameterizedTest" name="_10CorrectRegionSwitchoverWithAuthorization" description="#10 Correct region switchover with authorization" executed="True" result="Failure" success="False" time="39.907" asserts="2"> 
      <categories> 
       <category name="*Page" /> 
       <category name="LoginPage" /> 
       <category name="ErrorPage" /> 
      </categories> 
      <properties> 
       <property name="Description" value="#10 Correct region switchover with authorization" /> 
      </properties> 
      <failure> 
       <message><![CDATA[One or more child tests had errors]]></message> 
       <stack-trace /> 
      </failure> 
      <results> 
       <test-case name="QA.*.Tests.Features.Regionality.RegionalityFeature._10CorrectRegionSwitchoverWithAuthorization(&quot;*&quot;,&quot;*&quot;,&quot;moskva&quot;,&quot;/login/?returnUrl=https:*/&quot;,&quot;spb&quot;,&quot;*бург&quot;,&quot;/customers/products/&quot;,System.String[])" executed="True" result="Failure" success="False" time="39.904" asserts="2"> 
        <failure> 
         <message><![CDATA[ User is not authorized 
    Expected: not null and not <empty> 
    But was: <string.Empty> 
]]></message> 
         <stack-trace><![CDATA[в QA.*.Tests.Steps.Pages.*PageSteps.PageIsAuthorizedWithUser(String login) в c:\AutoTest3\source\QA.*.Tests\QA.*.Tests\Steps\Pages\*PageSteps.cs:строка 59 
в TechTalk.SpecFlow.Bindings.BindingInvoker.InvokeBinding(IBinding binding, IContextManager contextManager, Object[] arguments, ITestTracer testTracer, TimeSpan& duration) 
в TechTalk.SpecFlow.Infrastructure.TestExecutionEngine.ExecuteStepMatch(BindingMatch match, Object[] arguments) 
в TechTalk.SpecFlow.Infrastructure.TestExecutionEngine.ExecuteStep(StepInstance stepInstance) 
в TechTalk.SpecFlow.Infrastructure.TestExecutionEngine.OnAfterLastStep() 
в QA.*.Tests.Features.Regionality.RegionalityFeature._10CorrectRegionSwitchoverWithAuthorization(String login, String password, String region, String loginUrl, String newRegion, String newRegionTitle, String expectedUrl, String[] exampleTags) в c:\AutoTest3\source\QA.*.Tests\QA.*.Tests\Features\Regionality\Regionality.feature:строка 26 
]]></stack-trace> 
        </failure> 
       </test-case> 
      </results> 
     </test-suite> 
     <test-suite type="ParameterizedTest" name="_9CorrectRegionSwitchover" description="#9 Correct region switchover" executed="True" result="Success" success="True" time="24.251" asserts="1"> 
      <categories> 
       <category name="*Page" /> 
       <category name="ErrorPage" /> 
      </categories> 
      <properties> 
       <property name="Description" value="#9 Correct region switchover" /> 
      </properties> 
      <results> 
       <test-case name="QA.*.Tests.Features.Regionality.RegionalityFeature._9CorrectRegionSwitchover(&quot;moskva&quot;,&quot;/cu*/&quot;,&quot;spb&quot;,&quot;Санкт-Петербург&quot;,System.String[])" executed="True" result="Success" success="True" time="24.249" asserts="1" /> 
      </results> 
     </test-suite> 
    </results> 
</test-suite> 

有必要改變它以JSON把它放在elasticsearch 爲此，我選擇了Logstash 我的配置是這樣的：

input { 
    file { 
    path => "C:\AutoTest3\report\test.xml" 
    start_position => "beginning" 
    sincedb_path => "NUL" 
codec => multiline { 
    pattern => "</test-suite>" 
    negate => true 
    what => "previous" 
     auto_flush_interval => 1 
    } 
    } 
} 

filter { 
    xml { 
    source => "message" 
    target => "message.parsed" 
    xpath => [ 
       "/test-suite/results/test-suite/@name", name, 
       "/test-suite/results/test-suite/@success", success 
      ] 
    force_array => false 
    } 
    mutate { 
     remove_field => [ "path","@timestamp","host","tags","@version"] 
    } 

} 

output { 
file { 
codec => "json" 
path => ["C:/Logstash/temp.json"] 
} 
} 

從這個XML我需要做一個JSON有兩個條目： 名 成功

{ 
    "success": ["False"], 
    "name": ["_10CorrectRegionSwitchoverWithAuthorization"] 
} 
{ 
    "success": ["True"], 
    "name": ["_9CorrectRegionSwitchover"] 
} 

但我不明白我怎麼能寫多行模式（哪個元素導航），以便logstash明白我​​在這裏有2個事件。

Answer 1

這裏的解決方案

input { 
    file { 
    path => "C:\AutoTest3\report\test.xml" 
    start_position => "beginning" 
    sincedb_path => "NUL" 
codec => multiline { 
    pattern => "<test-suite type=" 
    negate => true 
    what => "previous" 
     auto_flush_interval => 1 
    } 
    } 
} 

filter { 
    xml { 
    source => "message" 
    target => "message.parsed" 
    xpath => [ 
       "/test-suite/@success", success, 
       "/test-suite/@name", name, 
       "/test-suite/@time", time, 
       "/test-suite/@description", description, 
       "/test-suite/results/test-suite/results/test-case/failure/message/text()", "message" 
      ] 
    force_array => false 
    } 
    mutate { 
     remove_field => [ "path","@timestamp","host","tags","@version","message","message.parsed"] 
    } 

} 

output { 
file { 
codec => "json" 
path => ["C:/Logstash/temp.json"] 
} 
}