# Filter data logstash error

**URL:** <https://discuss.elastic.co/t/filter-data-logstash-error/74070>\
**Category:** Logstash\
**Created:** [February 6, 2017, 2:41pm UTC](https://discuss.elastic.co/t/filter-data-logstash-error/74070 "2017-02-06T14:41:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![skb](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@skb](https://discuss.elastic.co/u/skb)\
**Post date:** [February 6, 2017, 2:41pm UTC](https://discuss.elastic.co/t/filter-data-logstash-error/74070/1 "2017-02-06T14:41:20Z")

</div>

```
<recorddata>
    <logrecordappdata>
        <atmevent>
            <eventcode>1234</eventcode>
            <worksation_id>123</worksation_id>
            <timestamp>2017/01/21</timestamp>
            <description>sampleevent</description>
            <event_data>
                <status>up</status>
                <previous_status>unknown</previous_status>
                <reason>na</reason>
                <devices>
                    <device>
                        <device_id>12</device_id>
                        <device_type>type1</device_type>
                        <status>1</status>
                        <error_code>0</error_code>
                        <severity>low</severity>
                        <etended_error_code>0</etended_error_code>
                        <atrributes>
                            <attribute>
                                <name>atm1</name>
                                <value>1</value>
                            </attribute>
                        </atrributes>
                    </device>
                     </devices>
            </event_data>
        </atmevent>
    </logrecordappdata>
</recorddata>

```

My code is

input {  
file {  
path =\> "/var/log/atm\_logs/satm5.xml"  
start\_position =\> "beginning"  
}  
}

filter {  
xml {  
store\_xml =\> false  
source =\> "message"  
xpath =\>  
[  
"/recorddata/logrecordappdata/atmevent/eventcode/text()", "atm\_eventcode",  
"/recorddata/logrecordappdata/atmevent/worksation\_id/text()", "atm\_wrkstid",  
"/recorddata/logrecordappdata/atmevent/timestamp/text()", "atm\_tmestamp",  
"/recorddata/logrecordappdata/atmevent/description/text()", "atm\_desc",  
"/recorddata/logrecordappdata/atmevent/event\_data/status/text()", "event\_status",  
"/recorddata/logrecordappdata/atmevent/event\_data/previous\_status/text()", "event\_prev\_status",  
"/recorddata/logrecordappdata/atmevent/event\_data/reason/text()", "event\_reason",  
"/recorddata/logrecordappdata/atmevent/event\_data/devices/device/device\_id/text()", "device\_id",  
"/recorddata/logrecordappdata/atmevent/event\_data/devices/device/device\_type/text()", "device\_type",  
"/recorddata/logrecordappdata/atmevent/event\_data/devices/device/status/text()", "device\_status",  
"/recorddata/logrecordappdata/atmevent/event\_data/devices/device/error\_code/text()", "device\_error\_code",  
"/recorddata/logrecordappdata/atmevent/event\_data/devices/device/severity/text()", "device\_severity",  
"/recorddata/logrecordappdata/atmevent/event\_data/devices/device/etended\_error\_code/text()", "device\_etend\_code",  
"/recorddata/logrecordappdata/atmevent/event\_data/devices/device/atrributes/atrribute/name/text()", "attr\_name",  
"/recorddata/logrecordappdata/atmevent/event\_data/devices/device/atrributes/atrribute/value/text()", "attr\_value"  
]  
}

}

output  
{  
elasticsearch  
{  
action =\> "index"  
hosts =\> ["192.168.1.19:9200"]  
index =\> "cmplx\_xml\_tags"  
}  
stdout  
{  
codec =\> rubydebug  
}  
}

....................................................................................................Error.....................................  
Error i am not getting desired output please help me out in this

```
   "message" => " </devices>",
  "@version" => "1",
"@timestamp" => "2017-02-06T14:29:05.372Z",
      "path" => "/var/log/atm_logs/satm5.xml",
      "host" => "lslave6.hdp.com"

```

}  
{  
"message" =\> " \</event\_data\>",  
"@version" =\> "1",  
"@timestamp" =\> "2017-02-06T14:29:05.372Z",  
"path" =\> "/var/log/atm\_logs/satm5.xml",  
"host" =\> "[lslave6.hdp.com](http://lslave6.hdp.com)"  
}  
{  
"message" =\> " ",  
"@version" =\> "1",  
"@timestamp" =\> "2017-02-06T14:29:05.373Z",  
"path" =\> "/var/log/atm\_logs/satm5.xml",  
"host" =\> "[lslave6.hdp.com](http://lslave6.hdp.com)"  
}  
{

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2017, 2:41pm UTC](https://discuss.elastic.co/t/filter-data-logstash-error/74070/2 "2017-03-06T14:41:31Z")

</div>

Closed on March 6, 2017, 2:41pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.