logstash解析xml文件问题

input

{

    file

    {

        path => "/tmp/es/logs/*.xml"

        start_position => "beginning"

        sincedb_path => "/dev/null"

        exclude => "*.gz"

        type => "xml"

        codec => multiline {

             pattern => "<a>" 

             negate => "true"

             what => "previous"

        }

    }

}



filter

{

  xml

  {

    source => "message"

    store_xml => false

    target => "stations"

    force_array => false

    xpath => [

      "/a/a1/text()", "a1",

      "/a/a2/a21/text()", "a21",

      "/a/a3/a31/text()", "a31"

    ]

  }

    mutate {

        remove_field => ["@timestamp", "@version","type","path","host","tags"]

        replace => { "a1" => "%{a1[0]}" }

        replace => { "a21" => "%{a21[0]}" }

        replace => { "a31" => "%{a31[0]}" }

    }

}



output

{

    stdout

    {

        codec => rubydebug

    }

}   

{

        "a21" => "22222",

         "a1" => "11111",

        "a31" => "33333",

    "message" => "<a>\n    <a1>11111</a1>\n     <a2>\n           <a21>22222</a21>\n     </a2>\n     <a3>\n           <a31>33333</a31>\n     </a3>\n</a>"

}