# Extract specific key and value in Logstash

**URL:** <https://discuss.elastic.co/t/extract-specific-key-and-value-in-logstash/76478>\
**Category:** Logstash\
**Created:** [February 25, 2017, 12:51pm UTC](https://discuss.elastic.co/t/extract-specific-key-and-value-in-logstash/76478 "2017-02-25T12:51:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gnievoj](https://avatars.discourse-cdn.com/v4/letter/g/a3d4f5/32.png) [@gnievoj](https://discuss.elastic.co/u/gnievoj)\
**Post date:** [February 25, 2017, 12:51pm UTC](https://discuss.elastic.co/t/extract-specific-key-and-value-in-logstash/76478/1 "2017-02-25T12:51:20Z")

</div>

Im using Logastash to collecting data from mysql. Json result looks :

```
     "_source" : {
            "username" : "room_test@localhost",
            "timestamp" : 1481785195811703,
            "peer" : "user@localhost/1596084304715518942270426",
            "bare_peer" : "user@localhost",
            "xml" : "<message to='room_test1481784717020@localhost' type='groupchat' from='user@localhost'><body>msg</body><jid>456-345</jid></message>",
            "txt" : "msg",
            "id" : 6452,
            "kind" : "groupchat",
            "nick" : "user",
            "created_at" : "2016-12-15T06:59:55.000Z",
            "@version" : "1",
            "@timestamp" : "2017-02-25T12:17:52.043Z"
          }

```

I need extract value from "xml" key as separate value. Like this "jid": 456-345

Thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 26, 2017, 2:16am UTC](https://discuss.elastic.co/t/extract-specific-key-and-value-in-logstash/76478/2 "2017-02-26T02:16:05Z")

</div>

What have you tried?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 27, 2017, 12:12pm UTC](https://discuss.elastic.co/t/extract-specific-key-and-value-in-logstash/76478/3 "2017-02-27T12:12:38Z")

</div>

Use the xml filter and its xpath option to extract the value.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2017, 12:12pm UTC](https://discuss.elastic.co/t/extract-specific-key-and-value-in-logstash/76478/4 "2017-03-27T12:12:51Z")

</div>

Closed on March 27, 2017, 12:12pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.