# Get element from xml

**URL:** <https://discuss.elastic.co/t/get-element-from-xml/92632>\
**Category:** Logstash\
**Created:** [July 11, 2017, 11:27am UTC](https://discuss.elastic.co/t/get-element-from-xml/92632 "2017-07-11T11:27:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohammed\_cherif](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mohammed\_cherif](https://discuss.elastic.co/u/mohammed_cherif)\
**Post date:** [July 11, 2017, 11:27am UTC](https://discuss.elastic.co/t/get-element-from-xml/92632/1 "2017-07-11T11:27:41Z")

</div>

I have the following logstash conf file:

```
input {
    jdbc {
        jdbc_connection_string => "jdbc:oracle:thin:@host:1521:sid"
        jdbc_user => "admin"
		jdbc_password => "admin"
        jdbc_validate_connection => true
        jdbc_driver_library => "C:\ELK\INSTALL\logstash-5.4.0\jdbc\ojdbc6.jar"
        jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
        statement => "SELECT user_id,name,status,startdate,updatedate,xmldata FROM account "
    }	
}

    filter {

   mutate {
        add_field => { 
            "xmldataAtt" 
        }
    }

ruby {
	   code => "
			if event.get('xmldata') != nil then
				xmldataAtt = event.get('xmldata')
			end
			"      
	}

xml {
  source => "xmldataAtt"
    xpath => [
	"/getTest//TestRequest/codifType/text()", "codif",
	"/getTest//TestRequest/currency/text()", "currency",
	"/getTest//TestRequest/date/text()", "dateCall",
	"/getTest//TestRequest/exchange/text()", "info"
	
   ]

}

}

output {
elasticsearch {
    index => "xmltest"
    hosts => "localhost:9200"
}

stdout { codec => json }

```

Example of xml :

```
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ns2:getTest xmlns:ns2="http://google.com" xmlns="http://google.com">

	<ns2:in0>
		<TestRequest>
			<codifType>type</codifType>
			<currency>MAD</currency>
			<date>2015-01-16T00:00:00.000+01:00</date>
			<exchange>TOTO123</exchange>
		</TestRequest>
	</ns2:in0>
	</ns2:getTest>

```

Thank's

---

<div class="post-metadata">

**Author:** ![Leandro\_Sampaio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_sampaio/32/18409_2.png) [@Leandro\_Sampaio](https://discuss.elastic.co/u/Leandro_Sampaio)\
**Post date:** [July 11, 2017, 11:44am UTC](https://discuss.elastic.co/t/get-element-from-xml/92632/2 "2017-07-11T11:44:13Z")

</div>

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html)

Why you couldnt use a filter xml??

---

<div class="post-metadata">

**Author:** ![mohammed\_cherif](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mohammed\_cherif](https://discuss.elastic.co/u/mohammed_cherif)\
**Post date:** [July 11, 2017, 12:23pm UTC](https://discuss.elastic.co/t/get-element-from-xml/92632/3 "2017-07-11T12:23:30Z")

</div>

i install the plugin **logstash-filter-xml** but how I can use it ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 12, 2017, 12:37pm UTC](https://discuss.elastic.co/t/get-element-from-xml/92632/4 "2017-07-12T12:37:42Z")

</div>

Just point the xml filter to the `xmldata` field. Your attempt to copy `xmldata` to `xmldataAtt` won't work and isn't useful anyway.

---

<div class="post-metadata">

**Author:** ![mohammed\_cherif](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mohammed\_cherif](https://discuss.elastic.co/u/mohammed_cherif)\
**Post date:** [July 12, 2017, 2:10pm UTC](https://discuss.elastic.co/t/get-element-from-xml/92632/5 "2017-07-12T14:10:13Z")

</div>

i found the solution using logstash-filter-xml.

filter {

```
xml {
	# store_xml => "false"
	source => xmldata
	target => "doc"
	add_tag => "xml"
}

 split {
	field => "doc[in0]"
	
  }
  
 split {
	field => "doc[in0][TestRequest]"
 }

 mutate {
	add_field => {

	  codif => "%{doc[in0][TestRequest][codifType]}"
	  currency => "%{doc[in0][TestRequest][currency]}"
	  date => "%{doc[in0][TestRequest][date]}"
	  exchange => "%{doc[in0][TestRequest][exchange]}"
	}
	
	  convert => { 
		"codif" => "string"
		"currency" => "string"
		"date" => "integer"
		"exchange" => "string"
	}
   
   
	remove_field => ['doc']
 }

```

}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2017, 2:10pm UTC](https://discuss.elastic.co/t/get-element-from-xml/92632/6 "2017-08-09T14:10:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.