# Best filter to match xml element and flag value **URL:** \ **Category:** Elasticsearch\ **Created:** [September 11, 2013, 11:53am UTC](https://discuss.elastic.co/t/best-filter-to-match-xml-element-and-flag-value/13554 "2013-09-11T11:53:13Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Major\_Slackr](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@Major\_Slackr](https://discuss.elastic.co/u/Major_Slackr)\ **Post date:** [September 11, 2013, 11:53am UTC](https://discuss.elastic.co/t/best-filter-to-match-xml-element-and-flag-value/13554/1 "2013-09-11T11:53:13Z")
Hi Guys, Apologies if this is a bit of a noddy question (I am a noob to this) but I couldn't find anything in the docs or the great G that really gave me a good answer to this problem.... In some of my logs I have events containing xml. I want to be able to identify the value of an element and create a new field containing the value. _Example event in log:_ INFO 2013-09-11 10:52:03,381 [[SmokeTest\_0906-v20130906-10+25].x\_to\_bss\_evt .stage1.22] (TranslateDealId.java:50) - Received raw message from x: \\EVT-Title-Updated\< /MessageType\>XY 115200591009311965115200591009311965\ .....etc I want to be able to create a field CORRELATIONID from the element 115200591009311965 and have it populate the value of the element into the field. So, in this case the CORRELATIONID flag vould have a value 1 15200591009311965, I had a look at grok methods using regex but could not see a way to do it. Any suggestions or help much appreciated.... Cheers! -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [September 12, 2013, 3:19pm UTC](https://discuss.elastic.co/t/best-filter-to-match-xml-element-and-flag-value/13554/2 "2013-09-12T15:19:34Z")
Hey, as elasticsearch is only parsing JSON, you would have to convert the XML to JSON before indexing it into elasticsearch. One possibility is to do this in your application code, the other way would be using regexes as you mentioned. See pattern replace char filter might be what you are searching for. See > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. --Alex On Wed, Sep 11, 2013 at 1:53 PM, Major\_Slackr [pthagonalthoughts@gmail.com](mailto:pthagonalthoughts@gmail.com)wrote: > Hi Guys, > > Apologies if this is a bit of a noddy question (I am a noob to this) but I > couldn't find anything in the docs or the great G that really gave me a > good answer to this problem.... > > In some of my logs I have events containing xml. I want to be able to > identify the value of an element and create a new field containing the > value. > > _Example event in log:_ > > INFO 2013-09-11 10:52:03,381 [[SmokeTest\_0906-v20130906-10+25]. > x\_to\_bss\_evt.stage1.22] (TranslateDealId.java:50) - Received raw message > from x: \\ "1.09" xmlns:rm="[.xyz Domain Names | Join Generation XYZ](http://xyz.com/rm/evt-title-updated)"\>EVT- > Title-UpdatedXY\< > /Target\>115200591009311965 > 115200591009311965.....etc > > I want to be able to create a field CORRELATIONID from the element > 115200591009311965 and have it populate > the value of the element into the field. > > So, in this case the CORRELATIONID flag vould have a value 1 > 15200591009311965, > > I had a look at grok methods using regex but could not see a way to do it. > > Any suggestions or help much appreciated.... > > Cheers! > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [September 12, 2013, 4:17pm UTC](https://discuss.elastic.co/t/best-filter-to-match-xml-element-and-flag-value/13554/3 "2013-09-12T16:17:51Z")
@Major_Slackr: is your question about logstash? -- David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) @dadoonet | @elasticsearchfr | @scrutmydocs Le 12 sept. 2013 à 17:19, Alexander Reelsen [alr@spinscale.de](mailto:alr@spinscale.de) a écrit : > Hey, > > as elasticsearch is only parsing JSON, you would have to convert the XML to JSON before indexing it into elasticsearch. One possibility is to do this in your application code, the other way would be using regexes as you mentioned. See pattern replace char filter might be what you are searching for. See [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/index-modules/analysis/pattern-replace-charfilter/) > > --Alex > > On Wed, Sep 11, 2013 at 1:53 PM, Major\_Slackr [pthagonalthoughts@gmail.com](mailto:pthagonalthoughts@gmail.com) wrote: > Hi Guys, > > Apologies if this is a bit of a noddy question (I am a noob to this) but I couldn't find anything in the docs or the great G that really gave me a good answer to this problem.... > > In some of my logs I have events containing xml. I want to be able to identify the value of an element and create a new field containing the value. > > Example event in log: > > INFO 2013-09-11 10:52:03,381 [[SmokeTest\_0906-v20130906-10+25].x\_to\_bss\_evt.stage1.22] (TranslateDealId.java:50) - Received raw message from x: \\EVT-Title-UpdatedXY115200591009311965115200591009311965.....etc > > I want to be able to create a field CORRELATIONID from the element 115200591009311965 and have it populate the value of the element into the field. > > So, in this case the CORRELATIONID flag vould have a value 115200591009311965, > > I had a look at grok methods using regex but could not see a way to do it. > > Any suggestions or help much appreciated.... > > Cheers! > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:16am UTC](https://discuss.elastic.co/t/best-filter-to-match-xml-element-and-flag-value/13554/4 "2017-07-06T02:16:52Z")