# Field imported as array

**URL:** <https://discuss.elastic.co/t/field-imported-as-array/119686>\
**Category:** Logstash\
**Created:** [February 13, 2018, 6:08pm UTC](https://discuss.elastic.co/t/field-imported-as-array/119686 "2018-02-13T18:08:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![davidcsi](https://avatars.discourse-cdn.com/v4/letter/d/8edcca/32.png) [@davidcsi](https://discuss.elastic.co/u/davidcsi)\
**Post date:** [February 13, 2018, 6:08pm UTC](https://discuss.elastic.co/t/field-imported-as-array/119686/1 "2018-02-13T18:08:14Z")

</div>

Hello guys,

I've been trying to do this for some time now, and finally some advance... but:

I've got some xml files, with one multiline event per file.

this is my conf:

```
    input {
  stdin {
    codec => multiline {
      pattern => "^<"
      negate => "true"
      what => "previous"
      auto_flush_interval => 1
    }
    type => xml
  }
}

filter {
  xml {
    source => message
    xpath => [
      "//cdr/state", "state",
      "//cdr/direction", "direction",
      "//cdr/call-stats/audio/inbound/media_packet_count", "inbound_media_packet_count",
      "//cdr/call-stats/audio/inbound/quality_percentage", "inbound_quality_percentage",
      "//cdr/call-stats/audio/inbound/mos", "inbound_mos",
      "//cdr/call-stats/audio/outbound/media_packet_count", "outbound_media_packet_count",
      "//cdr/call-stats/audio/outbound/quality_percentage", "outbound_quality_percentage",
      "//cdr/call-stats/audio/outbound/mos", "outbound_mos",
      "//cdr/variables/sip_gateway_name", "sip_gateway_name",
      "//cdr/variables/direction", "direction",
      "//cdr/variables/start_stamp", "start_stamp"
    ]
    store_xml => false
  }

  urldecode {
    all_fields => "true"
  }

  mutate {
    replace => [
      "start_stamp", "%{+YYYY.MM.dd} %{time}"
    ]
  }
}

output {
  elasticsearch { 
    hosts => ["cdr-elastic:9200"] 
    index => "cdr"
  }
  stdout { codec => rubydebug }
}

```

Finally this seems to be importing the specified fields into elastic, but it is inserting them as an array instead of a field... the xml part also seems to be wrong..

help is greatly appreciated!

The resulting doc is as follows (resumed):

```
  {
    "_index": "cdr",
    "_type": "doc",
    "_id": "HvNAhmEBVrPbe4FTPzxO",
    "_score": 1,
    "_source": {
      "outbound_media_packet_count": [
        "<media_packet_count>12029</media_packet_count>"
      ],
      "@timestamp": "2018-02-11T19:00:35.517Z",
      "inbound_media_packet_count": [
        "<media_packet_count>10673</media_packet_count>"
      ],
      "inbound_mos": [
        "<mos>4.48</mos>"
      ],
      "start_stamp": "2018.02.11 %{time}",
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2018, 6:08pm UTC](https://discuss.elastic.co/t/field-imported-as-array/119686/2 "2018-03-13T18:08:18Z")

</div>

Closed on March 13, 2018, 6:08pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.