# Enable to pick values from below parsed logs

**URL:** <https://discuss.elastic.co/t/enable-to-pick-values-from-below-parsed-logs/121197>\
**Category:** Logstash\
**Created:** [February 23, 2018, 10:27am UTC](https://discuss.elastic.co/t/enable-to-pick-values-from-below-parsed-logs/121197 "2018-02-23T10:27:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Manjunatha](https://avatars.discourse-cdn.com/v4/letter/m/34f0e0/32.png) [@Manjunatha](https://discuss.elastic.co/u/Manjunatha)\
**Post date:** [February 23, 2018, 10:27am UTC](https://discuss.elastic.co/t/enable-to-pick-values-from-below-parsed-logs/121197/1 "2018-02-23T10:27:27Z")

</div>

Hi Team,

I have parsed the XML based logs can you please help me to get the elements as mentioned below.

Parsed Logs:  
"payload" =\> "\<bal:balanceTopUp xmlns:bal="[http://soa.three.ie/balancemanagementdata\_1\_0](http://soa.three.ie/balancemanagementdata_1_0)" xmlns:wsse="[http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd](http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd)" xmlns:soapenv="[http://schemas.xmlsoap.org/soap/envelope/](http://schemas.xmlsoap.org/soap/envelope/)"\> bal:subscriptionId353861350479\</bal:subscriptionId\> bal:idhrhy565\</bal:id\> bal:typeCASH RECHARGE\</bal:type\> bal:descriptiontopup required\</bal:description\> bal:channelbal:name3RDPARTY\</bal:name\> \</bal:channel\> bal:placebal:namePAYZONE\</bal:name\> \</bal:place\> bal:requestorbal:nameusha\</bal:name\> \</bal:requestor\> bal:amountbal:amount10\</bal:amount\> bal:unitsEUR\</bal:units\> \</bal:amount\> bal:paymentMeanbal:id34567\</bal:id\> bal:nameRPM\</bal:name\> \</bal:paymentMean\> bal:relatedPartybal:id797\</bal:id\> bal:nameHarshitha\</bal:name\> \</bal:relatedParty\> bal:reasonrecharge\</bal:reason\> \</bal:balanceTopUp\>",  
"parsed" =\> {  
"reason" =\> [  
[0] "recharge"  
],  
"xmlns:bal" =\> "[http://soa.three.ie/balancemanagementdata\_1\_0](http://soa.three.ie/balancemanagementdata_1_0)",  
"subscriptionId" =\> [  
[0] "353861350479"  
],  
"xmlns:wsse" =\> "[http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd](http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd)",  
"channel" =\> [  
[0] {  
"name" =\> [  
[0] "3RDPARTY"  
]  
}  
],  
"requestor" =\> [  
[0] {  
"name" =\> [  
[0] "usha"  
]  
}  
],  
"amount" =\> [  
[0] {  
"amount" =\> [  
[0] "10"  
],  
"units" =\> [  
[0] "EUR"  
]  
}  
],  
"id" =\> [  
[0] "hrhy565"  
],  
"place" =\> [  
[0] {  
"name" =\> [  
[0] "PAYZONE"  
]  
}  
],  
"paymentMean" =\> [  
[0] {  
"id" =\> [  
[0] "34567"  
],  
"name" =\> [  
[0] "RPM"  
]  
}  
],  
"xmlns:soapenv" =\> "[http://schemas.xmlsoap.org/soap/envelope/](http://schemas.xmlsoap.org/soap/envelope/)",  
"description" =\> [  
[0] "topup required"  
],  
"type" =\> [  
[0] "CASH RECHARGE"  
],  
"relatedParty" =\> [  
[0] {  
"id" =\> [  
[0] "797"  
],  
"name" =\> [  
[0] "Harshitha"  
]  
}  
]

}

Please, can someone help me to get below elements in those parsed elements?

subscriptionId  
channel  
requestor  
amount  
units  
description  
type  
type

I need to pick above elements and pass these elements to CSV file using logstash.

Thanks  
Manju

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2018, 10:27am UTC](https://discuss.elastic.co/t/enable-to-pick-values-from-below-parsed-logs/121197/2 "2018-03-23T10:27:38Z")

</div>

Closed on March 23, 2018, 10:27am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.