# Help with Logstash xml filter plug in

**URL:** <https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131>\
**Category:** Logstash\
**Created:** [January 22, 2020, 8:30pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131 "2020-01-22T20:30:43Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![byoungman](https://avatars.discourse-cdn.com/v4/letter/b/838e76/32.png) [@byoungman](https://discuss.elastic.co/u/byoungman)\
**Post date:** [January 22, 2020, 8:30pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131/1 "2020-01-22T20:30:43Z")

</div>

I'm having trouble parsing out fields from my xml file using the logstash xml filter plugin.

Here is my xml file data--  
  
  
733812  
JVM|Garbage Collection|Number of Minor Collections Per Min  
Application Infrastructure Performance|OSP Servers|JVM|Garbage Collection|Number of Minor Collections Per Min  
ONE\_MIN  
  
  
1579723620000  
0  
0  
0  
0  
true  
30  
0  
0  
0

And this is my logstash.conf set up--  
input {  
file {  
path =\> "C:/AppDynamics/Metrics-Data/\*.xml"  
type =\> "xml"  
codec =\> multiline {  
pattern =\> "\r\n"  
negate =\> "true"  
what =\> "previous"  
}  
mode =\> "read"  
file\_completed\_action =\> "delete"  
add\_field =\> {  
"es\_index" =\> "appdynamics-metrics"  
}  
}  
}

```
filter
{
	xml {
		source => "message"
		target => "theXML"
		store_xml => "false"
    xpath => ["//metric-datas/metric-data/metricId/text()","metricId"]
	}
}

output {
	elasticsearch {
		hosts => ["http://localhost:9200"]
		index => "%{[es_index]}-%{+YYYY.MM.dd}"
	}
}

```

My end goal is to create fields for all of the metric-data attributes.

What am I missing here as I can not get it to work. Attached is my Kibana output.

 ![AppD-Metrics-Kibana-Screenshot](https://us1.discourse-cdn.com/elastic/original/3X/6/5/65685b6713af0e6ee37692cc63770b23692bf8d5.png)

TIA,  
Bill Youngman

---

<div class="post-metadata">

**Author:** ![byoungman](https://avatars.discourse-cdn.com/v4/letter/b/838e76/32.png) [@byoungman](https://discuss.elastic.co/u/byoungman)\
**Post date:** [January 22, 2020, 8:33pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131/2 "2020-01-22T20:33:07Z")

</div>

The xml data didn't come across correctly formatted so attaching it as an image.

 ![AppD-Metrics-xml-data-Screenshot](https://us1.discourse-cdn.com/elastic/original/3X/4/9/4980b3b893f13e304d6e3951ef7d69d88cf89178.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 22, 2020, 9:24pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131/3 "2020-01-22T21:24:41Z")

</div>

Use [markdown](https://github.com/adam-p/markdown-here/wiki/Markdown-Cheatsheet) to protect the XML from being interpreted as HTML. Edit your post, select the XML and click on \</\> in the toolbar above the edit pane. Then do the same with your configuration.

---

<div class="post-metadata">

**Author:** ![byoungman](https://avatars.discourse-cdn.com/v4/letter/b/838e76/32.png) [@byoungman](https://discuss.elastic.co/u/byoungman)\
**Post date:** [January 23, 2020, 1:43pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131/4 "2020-01-23T13:43:22Z")

</div>

Thanks for the suggestion Badger

---

<div class="post-metadata">

**Author:** ![byoungman](https://avatars.discourse-cdn.com/v4/letter/b/838e76/32.png) [@byoungman](https://discuss.elastic.co/u/byoungman)\
**Post date:** [January 23, 2020, 7:10pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131/5 "2020-01-23T19:10:34Z")

</div>

```
<metric-datas>
  <metric-data>
    <metricId>733812</metricId>
    <metricName>JVM|Garbage Collection|Number of Minor Collections Per Min</metricName>
    <metricPath>Application Infrastructure Performance|OSP Servers|JVM|Garbage Collection|Number of Minor Collections Per Min</metricPath>
    <frequency>CUSTOM</frequency>
    <metricValues>
      <metric-value>
        <startTimeInMillis>1579805400000</startTimeInMillis>
        <occurrences>16</occurrences>
        <current>0</current>
        <min>0</min>
        <max>0</max>
        <useRange>true</useRange>
        <count>32</count>
        <sum>0</sum>
        <value>0</value>
        <standardDeviation>0</standardDeviation>
      </metric-value>
    </metricValues>
  </metric-data>
</metric-datas>
```

---

<div class="post-metadata">

**Author:** ![byoungman](https://avatars.discourse-cdn.com/v4/letter/b/838e76/32.png) [@byoungman](https://discuss.elastic.co/u/byoungman)\
**Post date:** [January 23, 2020, 8:09pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131/6 "2020-01-23T20:09:44Z")

</div>

So I've set my logging level to 'trace' and it appears that the xpath is being processed but the tag is not making it into my ES index--

`xpath => ["/metric-datas/metric-data/metricId/text()","metricId"]`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 23, 2020, 9:21pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131/7 "2020-01-23T21:21:37Z")

</div>

Running the filter you showed against the xml you showed gets me

```
  "metricId" => [
    [0] "733812"
]

```

on the event.

---

<div class="post-metadata">

**Author:** ![byoungman](https://avatars.discourse-cdn.com/v4/letter/b/838e76/32.png) [@byoungman](https://discuss.elastic.co/u/byoungman)\
**Post date:** [January 24, 2020, 1:35pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131/8 "2020-01-24T13:35:48Z")

</div>

Thanks Badger - I'm new with working with this plugin so not understanding what I am doing wrong and how to fix it.

-Bill

---

<div class="post-metadata">

**Author:** ![byoungman](https://avatars.discourse-cdn.com/v4/letter/b/838e76/32.png) [@byoungman](https://discuss.elastic.co/u/byoungman)\
**Post date:** [January 24, 2020, 2:16pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131/9 "2020-01-24T14:16:24Z")

</div>

Latest update --

I updated my xml filter to this --

```
xml {
	remove_namespaces => "true"
	source => "message"
	store_xml => "true"
	target => "doc"
	force_array => false
    xpath => ["//metricId/text()","metricId"]
}

```

I know see the xml attributes as below but still no 'metricId' field in ES

doc.metric-data.metricId  
doc.metric-data.metricName  
doc.metric-data.metricPath  
doc.metric-data.metricValues.metric-value.count  
etc...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2020, 2:16pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131/10 "2020-02-21T14:16:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.