0

I have a Logstash conf where I split an incoming XML into multiple events. I would like to write a file per event. However, the file output writes all the events to a single file (so an event per line). Is there a way to achieve this?

.......

filter {

xml{
   store_xml => "false"
   source => "message"
remove_namespaces => true
xpath => 
 [
"/root/Envelope", "Envelopes"         
   ]
  }

mutate {
    remove_field => ["message"]
  }

 split{
  field => "Envelopes"
 }
}

output {
file {
path => "/install/logstash/output-CL102-%{+yyyyMMddHHmmss}.xml"
}
}

Thanks

Romario
  • 1

1 Answers1

0

Change the path in the output. Do you have an 'id' field or some other unique field in the source xml? If so, use that in the output path.

Alain Collins
  • 16,268
  • 2
  • 32
  • 55