# Getting timestamp field from XML attribute **URL:** \ **Category:** Logstash\ **Created:** [January 17, 2022, 7:58pm UTC](https://discuss.elastic.co/t/getting-timestamp-field-from-xml-attribute/294625 "2022-01-17T19:58:50Z")\ **Posts on this page:** 1\ **Showing post:** 8
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 18, 2022, 8:08pm UTC](https://discuss.elastic.co/t/getting-timestamp-field-from-xml-attribute/294625/8 "2022-01-18T20:08:50Z")
> [@Tim\_Mobley](#): > > My fields have concrete values (from either the XML element or attribute). Not exactly. The default for store\_xml is true, so the complete XML document is parsed and stored in the target field (doc, in your case). [doc] is an object which has many objects nested inside it. So, based on an SCAP file I found online, it might contain a [doc][Benchmark][TestResult][rule-result][result][override][old-result] field that has a concrete value in it. But the 6 fields that parent it are all objects, not just fields. For debugging purposes, set store\_xml to false and verify the fields you are extracting with xpath look OK. If this `mapping [doc.Value.value]` is not obfuscated then that is the field that is causing the problem. Check the [mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html) of the index. Turn store\_xml back on and replace the elasticsearch index with `output { stdout { codec => rubydebug } }` and see that the format of [doc][Value] is. See [this](https://discuss.elastic.co/t/getting-illegal-state-exception-error-while-pushing-logs-to-elasticsearch/290029/2) post for ideas on how to reformat the data once you have decided whether you want it to be a concrete value or an object. --- _[View the full topic](https://discuss.elastic.co/t/getting-timestamp-field-from-xml-attribute/294625)._