# How can I use if condition in filter for xml

**URL:** <https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055>\
**Category:** Logstash\
**Created:** [April 6, 2018, 8:40am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055 "2018-04-06T08:40:56Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![seungtae](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seungtae/32/71413_2.png) [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Post date:** [April 6, 2018, 8:40am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/1 "2018-04-06T08:40:57Z")

</div>

Is there any solution about using if condition in filter?

I want if there is some tags in xml source, do filter about xml, mutae, ruby , ect...

First, my xml source is like this :

```
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<m2m:cin xmlns:m2m="http://www.onem2m.org/xml/protocols" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<ty>4</ty>
<ri>CI00000000001244656716</ri>
<rn>CI00000000001244656716</rn>
<pi>CT00000000000000046769</pi>
<ct>2018-02-05T15:06:30+09:00</ct>
<lt>2018-02-05T15:06:30+09:00</lt>
<ppt>
<gwl>36.83115, 127.11185, 76</gwl>
<geui>0017b2fffe0ad93e</geui>
</ppt>
<sr>/0240771000000168/v1_0/remoteCSE-00000168000c05c016104807/container-LoRa//subscription-SS00000000000000261472</sr>
<et>2018-02-06T15:06:30+09:00</et>
<st>11785</st>
<cr>RC00000000000000050648</cr>
<cnf>LoRa/Sensor</cnf>
<cs>76</cs>
<con>010400003039499602d2499602d203e703e70000000003e703e70000000000000000fff51234</con>
</m2m:cin>

```

And my filter is like this :

```
filter {
	if(....){
		xml{
			source => "message"
        	store_xml => false        
        	xpath => ["/m2m:cin/sr", "parsedSr"]
			xpath => ["/m2m:cin/con", "parsedCon"]

   		}	
    	mutate{
			gsub => ["parsedCon", "<[^<]*>", ""]
			gsub => ["parsedSr", "<[^<]*>", ""]		
			remove_field => "headers" 
			remove_field => "@timestamp" 
			remove_field => "@version" 
		}

		ruby{
    		path => "C:\workspace_server/parser.rb"
		}

		mutate {
			remove_field => "parsedSr"
			remove_field => "parsedCon"
		}
	}

}        

```

I want if there are `<con>` and`<sr>` tags in xml source, do xml {..} ~ mutate {..}

How do I write in if condition ??

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 6, 2018, 11:32am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/2 "2018-04-06T11:32:50Z")

</div>

Use an xml filter with `store_xml => true` to parse the XML completely. Then you can access the whole XML structure via fields. If you use a `stdout { codec => rubydebug }` output to dump the raw event produced by Logstash it'll be easier to help.

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [April 6, 2018, 2:59pm UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/3 "2018-04-06T14:59:43Z")

</div>

I'm assuming after it's ingested the data will be present as a string in the `[message]` field. Not sure if @magnusbaeck's method is faster than this but I think this would work too.

```
if [message] =~ "(<con>|<sr>)" {
  do stuff
}
```

---

<div class="post-metadata">

**Author:** ![seungtae](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seungtae/32/71413_2.png) [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Post date:** [April 9, 2018, 12:22am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/4 "2018-04-09T00:22:35Z")

</div>

Thank you for your reply @wwalker

I added your solution like this :

```
filter {

	xml{
		source => "message"
        store_xml => true
       	target => "parsedData"        
       	xpath => ["/m2m:cin/sr", "parsedSr"]
		xpath => ["/m2m:cin/con", "parsedCon"]
	}

    mutate{
		gsub => ["parsedCon", "<[^<]*>", ""]
		gsub => ["parsedSr", "<[^<]*>", ""]		
		remove_field => "headers" 
		remove_field => "@timestamp" 
		remove_field => "@version" 
	}

	ruby{
    	path => "C:\workspace_server/parser.rb"
	}

	mutate {
		remove_field => "parsedSr"
		remove_field => "parsedCon"
	}

	if[message] =~ "(<con>|<sr>)" {
		do stuff
	}

}

```

But there is an error. It can be checked by console.

[2018-04-09T09:19:18,557][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Expected one of #, { at line 35, column 6 (byte 571) after filter {\n\n\txml{\n\t\tsource =\> "message"\n store\_xml =\> true\n \ttarget =\> "parsedData" \n \txpath =\> ["/m2m:cin/sr", "parsedSr"]\n\t\txpath =\> ["/m2m:cin/con", "parsedCon"]\n\t}\n\n mutate{\n\t\tgsub =\> ["parsedCon", "\<[^\<]_\>", ""]\n\t\tgsub =\> ["parsedSr", "\<[^\<]_\>", ""]\t\t\n\t\tremove\_field =\> "headers" \n\t\tremove\_field =\> "@timestamp" \n\t\tremove\_field =\> "@version" \n\t}\n\n\truby{\n \tpath =\> "C:\workspace\_server/parser.rb"\n\t}\n\n\tmutate {\n\t\tremove\_field =\> "parsedSr"\n\t\tremove\_field =\> "parsedCon"\n\t}\n\n\tif[message] =~ "(|)" {\n\t\tdo ", :backtrace=\>["C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:51:in`initialize'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline\_action/reload.rb:34:in `execute'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:315:in`block in converge\_state'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:312:in`block in converge\_state'", "org/jruby/RubyArray.java:1734:in `each'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:299:in`converge\_state'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:166:in `block in converge_state_and_update'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:141:in`with\_pipelines'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:164:in `converge_state_and_update'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:105:in`block in execute'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/interval.rb:18:in `interval'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/agent.rb:94:in`execute'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/runner.rb:348:in `block in execute'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in`block in initialize'"]}

---

<div class="post-metadata">

**Author:** ![seungtae](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seungtae/32/71413_2.png) [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Post date:** [April 9, 2018, 12:27am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/5 "2018-04-09T00:27:48Z")

</div>

Thank you for your reply @magnusbaeck.

I set up store\_xml =\> true and target =\> "parsedData" .

My filter is like this:

filter {

```
xml{
	source => "message"
    store_xml => true
   	target => "parsedData"        
   	xpath => ["/m2m:cin/sr", "parsedSr"]
	xpath => ["/m2m:cin/con", "parsedCon"]
}

mutate{
	gsub => ["parsedCon", "<[^<]*>", ""]
	gsub => ["parsedSr", "<[^<]*>", ""]		
	remove_field => "headers" 
	remove_field => "@timestamp" 
	remove_field => "@version" 
}

ruby{
	path => "C:\workspace_server/parser.rb"
}

mutate {
	remove_field => "parsedSr"
	remove_field => "parsedCon"
}

```

}

So I can see whole XML structure.

{  
"message" =\> "\<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\>\r\n\<m2m:cin xmlns:m2m="[http://www.onem2m.org/xml/protocols](http://www.onem2m.org/xml/protocols)" xmlns:xsi="[http://www.w3.org/2001/XMLSchema-instance](http://www.w3.org/2001/XMLSchema-instance)"\>\r\n4\r\nCI00000000001244656716\r\nCI00000000001244656716\r\nCT00000000000000046769\r\n2018-02-05T15:06:30+09:00\r\n2018-02-05T15:06:30+09:00\r\n\r\n36.83115, 127.11185, 76\r\n0017b2fffe0ad93e\r\n\r\n/0240771000000168/v1\_0/remoteCSE-00000168000c05c016104807/container-LoRa//subscription-SS00000000000000261472\r\n2018-02-06T15:06:30+09:00\r\n11785\r\nRC00000000000000050648\r\nLoRa/Sensor\r\n76\r\n010400003039499602d2499602d203e703e70000000003e703e70000000000000000fff51234\r\n\</m2m:cin\>",  
"LoraID" =\> "00000168000c05c016104807",  
"parsedData" =\> {  
"st" =\> [  
[0] "11785"  
],  
"ppt" =\> [  
[0] {  
"geui" =\> [  
[0] "0017b2fffe0ad93e"  
],  
"gwl" =\> [  
[0] "36.83115, 127.11185, 76"  
]  
}  
],  
"cr" =\> [  
[0] "RC00000000000000050648"  
],  
"xmlns:xsi" =\> "[http://www.w3.org/2001/XMLSchema-instance](http://www.w3.org/2001/XMLSchema-instance)",  
"sr" =\> [  
[0] "/0240771000000168/v1\_0/remoteCSE-00000168000c05c016104807/container-LoRa//subscription-SS00000000000000261472"  
],  
"xmlns:m2m" =\> "[http://www.onem2m.org/xml/protocols](http://www.onem2m.org/xml/protocols)",  
"cs" =\> [  
[0] "76"  
],  
"et" =\> [  
[0] "2018-02-06T15:06:30+09:00"  
],  
"con" =\> [  
[0] "010400003039499602d2499602d203e703e70000000003e703e70000000000000000fff51234"  
],  
"rn" =\> [  
[0] "CI00000000001244656716"  
],  
"lt" =\> [  
[0] "2018-02-05T15:06:30+09:00"  
],  
"pi" =\> [  
[0] "CT00000000000000046769"  
],  
"ct" =\> [  
[0] "2018-02-05T15:06:30+09:00"  
],  
"cnf" =\> [  
[0] "LoRa/Sensor"  
],  
"ty" =\> [  
[0] "4"  
],  
"ri" =\> [  
[0] "CI00000000001244656716"  
]  
},  
"host" =\> "0:0:0:0:0:0:0:1",  
"output\_result" =\> {  
"inv\_tp" =\> 1234567890,  
"err\_sw" =\> "0001001000110100",  
"inv\_cp" =\> 12345,  
"in\_ia" =\> 999,  
"out\_it" =\> 0,  
"out\_ir" =\> 999,  
"out\_vt" =\> 0,  
"inverter" =\> 4,  
"energy" =\> 1,  
"out\_vs" =\> 0,  
"out\_vr" =\> 999,  
"out\_is" =\> 0,  
"in\_va" =\> 999,  
"in\_vb" =\> 0,  
"err\_hw" =\> "1111111111110101",  
"in\_ib" =\> 0,  
"inv\_dp" =\> 1234567890  
}  
}

So, what should I add if condition next?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 9, 2018, 6:02am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/6 "2018-04-09T06:02:55Z")

</div>

> So, what should I add if condition next?

This checks whether the XML contained an sr element:

```
if [parsedData][sr] {

```

But why not just extract the sr and con elements with an xml filter (without `store_xml` enabled but with the `xpath` option you've already set) and check the resulting fields?

---

<div class="post-metadata">

**Author:** ![seungtae](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seungtae/32/71413_2.png) [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Post date:** [April 9, 2018, 6:07am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/7 "2018-04-09T06:07:07Z")

</div>

@magnusbaeck Thank you so mush!

I use if condition in output like this :

```
output {
	if([parsedData][con] and [parsedData][sr]){
		elasticsearch {
			index => "parse"
			hosts => "localhost:9200"
		}
	}

	if([output_result][energy] == 1 and [output_result][inverter] == 4){
		stdout {	
			codec => rubydebug
		}
	}
} 

```

It's work correctly..  
And I want to know one more information..  
Can I check the input sorce is xml or not?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 9, 2018, 6:08am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/8 "2018-04-09T06:08:57Z")

</div>

> Can I check the input sorce is xml or not?

You could use a regexp-based conditional, but I'd probably just try feeding it to the xml filter and see if Logstash tags it with `_xmlparsefailure`.

---

<div class="post-metadata">

**Author:** ![seungtae](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seungtae/32/71413_2.png) [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Post date:** [April 9, 2018, 6:13am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/9 "2018-04-09T06:13:42Z")

</div>

@magnusbaeck Thank you for your reply!

Because I ask this question, if the input source is not xml source, Logstash's connect has been broken.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 9, 2018, 6:15am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/10 "2018-04-09T06:15:42Z")

</div>

> Because I ask this question, if the input source is not xml source, Logstash's connect has been broken.

I don't understand what you mean.

---

<div class="post-metadata">

**Author:** ![seungtae](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seungtae/32/71413_2.png) [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Post date:** [April 9, 2018, 6:23am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/11 "2018-04-09T06:23:32Z")

</div>

@magnusbaeck  
Um.. I send the xml source to logstash by Postman. If the xml source's structure is accurate, Logstash works well. But if I send the xml source like this :

`<?xml version="1.0" encoding="UTF-8" standalone="yes"? dd>`

> At the end of character 'dd' is not accurate structure of XML.  
> If this source is sent to Logstash, Logstash's connection will be broken. The Error is like this :

[2018-04-09T15:20:30,324][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 9, 2018, 6:44am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/12 "2018-04-09T06:44:00Z")

</div>

Really? Please show more of the log. The xml filter shouldn't stall the pipeline.

---

<div class="post-metadata">

**Author:** ![seungtae](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seungtae/32/71413_2.png) [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Post date:** [April 9, 2018, 6:51am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/13 "2018-04-09T06:51:58Z")

</div>

@magnusbaeck

> Ok.. I show you full log.

[2018-04-09T15:50:54,973][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline\_id=\>"main", "exception"=\>"/m2m:cin/sr", "backtrace"=\>["nokogiri/XmlXpathContext.java:130:in `evaluate'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:198:in `xpath\_impl'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:179:in `xpath_internal'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:154:in `xpath'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:153:in `block in filter'", "org/jruby/RubyHash.java:1343:in `each'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:152:in `filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:145:in `do\_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:164:in `block in multi_filter'", "org/jruby/RubyArray.java:1734:in `each'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:161:in `multi_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filter_delegator.rb:47:in `multi\_filter'", "(eval):127:in `block in filter_func'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:447:in `filter\_batch'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:426:in `worker_loop'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:385:in `block in start\_workers'"], :thread=\>"#\<Thread:0x48c92bf sleep\>"}  
[2018-04-09T15:50:57,058][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<Nokogiri::XML::XPath::SyntaxError: /m2m:cin/sr\>, :backtrace=\>["nokogiri/XmlXpathContext.java:130:in `evaluate'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:198:in `xpath\_impl'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:179:in `xpath_internal'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:154:in `xpath'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:153:in `block in filter'", "org/jruby/RubyHash.java:1343:in `each'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:152:in `filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:145:in `do\_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:164:in `block in multi_filter'", "org/jruby/RubyArray.java:1734:in `each'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:161:in `multi_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filter_delegator.rb:47:in `multi\_filter'", "(eval):127:in `block in filter_func'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:447:in `filter\_batch'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:426:in `worker_loop'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:385:in `block in start\_workers'"]}  
[2018-04-09T15:50:57,110][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit  
2018-04-09 15:50:57 +0900: Listen loop error: #\<IOError: closed stream\>  
org/jruby/RubyIO.java:3405:in `select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle\_servers'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run' 2018-04-09 15:50:57 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:in `select'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run'  
2018-04-09 15:50:57 +0900: Listen loop error: #\<IOError: closed stream\>  
org/jruby/RubyIO.java:3405:in `select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle\_servers'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run' 2018-04-09 15:50:57 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:in `select'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run'  
2018-04-09 15:50:57 +0900: Listen loop error: #\<IOError: closed stream\>  
C:\logstash-6.2.3\logstash-6.2.3\bin\>

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 9, 2018, 7:06am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/14 "2018-04-09T07:06:04Z")

</div>

The problem is with your XPath syntax. Perhaps you can work around this by setting `remove_namespaces` to true? Otherwise I don't know.

---

<div class="post-metadata">

**Author:** ![seungtae](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seungtae/32/71413_2.png) [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Post date:** [April 9, 2018, 7:16am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/15 "2018-04-09T07:16:09Z")

</div>

@magnusbaeck Thank you for your reply.

I don't set remove\_namespaces to true.  
But if I set that to true just now, Logstash's connect is broke by accurate xml source .

---

<div class="post-metadata">

**Author:** ![seungtae](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seungtae/32/71413_2.png) [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Post date:** [April 9, 2018, 7:16am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/16 "2018-04-09T07:16:50Z")

</div>

The Error is like this :

[2018-04-09T16:14:14,885][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline\_id=\>"main", "exception"=\>"/m2m:cin/sr", "backtrace"=\>["nokogiri/XmlXpathContext.java:130:in `evaluate'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:198:in`xpath\_impl'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:179:in `xpath_internal'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:154:in`xpath'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:153:in `block in filter'", "org/jruby/RubyHash.java:1343:in`each'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:152:in `filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:145:in`do\_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:164:in `block in multi_filter'", "org/jruby/RubyArray.java:1734:in`each'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:161:in `multi_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filter_delegator.rb:47:in`multi\_filter'", "(eval):127:in `block in filter_func'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:447:in`filter\_batch'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:426:in `worker_loop'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:385:in`block in start\_workers'"], :thread=\>"#\<Thread:0x2a4dd939 sleep\>"}  
[2018-04-09T16:14:14,907][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<Nokogiri::XML::XPath::SyntaxError: /m2m:cin/sr\>, :backtrace=\>["nokogiri/XmlXpathContext.java:130:in `evaluate'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:198:in`xpath\_impl'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:179:in `xpath_internal'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/nokogiri-1.8.2-java/lib/nokogiri/xml/searchable.rb:154:in`xpath'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:153:in `block in filter'", "org/jruby/RubyHash.java:1343:in`each'", "C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:152:in `filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:145:in`do\_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:164:in `block in multi_filter'", "org/jruby/RubyArray.java:1734:in`each'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filters/base.rb:161:in `multi_filter'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/filter_delegator.rb:47:in`multi\_filter'", "(eval):127:in `block in filter_func'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:447:in`filter\_batch'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:426:in `worker_loop'", "C:/logstash-6.2.3/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:385:in`block in start\_workers'"]}  
2018-04-09 16:14:14 +0900: Listen loop error: #\<IOError: closed stream\>  
org/jruby/RubyIO.java:3022:in `read' org/jruby/RubyIO.java:2993:in`read'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:376:in `handle_check' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:325:in`block in handle\_servers'  
org/jruby/RubyArray.java:1734:in `each' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:323:in`handle\_servers'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run'

---

<div class="post-metadata">

**Author:** ![seungtae](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seungtae/32/71413_2.png) [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Post date:** [April 9, 2018, 7:17am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/17 "2018-04-09T07:17:01Z")

</div>

> This is another error

[2018-04-09T16:14:14,955][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit  
2018-04-09 16:14:14 +0900: Listen loop error: #\<IOError: closed stream\>  
org/jruby/RubyIO.java:3405:in `select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle\_servers'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run' 2018-04-09 16:14:14 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:in `select'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run'  
2018-04-09 16:14:14 +0900: Listen loop error: #\<IOError: closed stream\>  
org/jruby/RubyIO.java:3405:in `select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle\_servers'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run' 2018-04-09 16:14:15 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:in `select'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run'  
2018-04-09 16:14:15 +0900: Listen loop error: #\<IOError: closed stream\>  
org/jruby/RubyIO.java:3405:in `select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle\_servers'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run' 2018-04-09 16:14:15 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:in `select'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run'  
2018-04-09 16:14:15 +0900: Listen loop error: #\<IOError: closed stream\>  
org/jruby/RubyIO.java:3405:in `select' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle\_servers'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run' 2018-04-09 16:14:15 +0900: Listen loop error: #<IOError: closed stream> org/jruby/RubyIO.java:3405:in `select'  
C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle_servers' C:/logstash-6.2.3/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `block in run'  
2018-04-09 16:14:15 +0900: Listen loop error: #\<IOError: closed stream\>

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 9, 2018, 7:30am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/18 "2018-04-09T07:30:48Z")

</div>

With `remove_namespaces` enabled you should remove "m2m:" from your XPath expression so it boils down to /cin/sr.

---

<div class="post-metadata">

**Author:** ![seungtae](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seungtae/32/71413_2.png) [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Post date:** [April 9, 2018, 7:38am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/19 "2018-04-09T07:38:21Z")

</div>

@magnusbaeck  
Oh.. Thank you very much! It works well.  
And I found namespaces plugins. So, I change code like this :

```
filter {
	xml{	
		namespaces => {
			"xmlns:m2m" => "http://www.onem2m.org/xml/protocols"
			"xmlns:xsi" => "http://www.w3.org/2001/XMLSchema-instance"
		}
		source => "message"
        store_xml => true
       	target => "parsedData"     
       	xpath => ["/m2m:cin/sr", "parsedSr"]
       	xpath => ["/m2m:cin/con", "parsedCon"]
	}

```

It works same with remove\_namespaces?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2018, 7:38am UTC](https://discuss.elastic.co/t/how-can-i-use-if-condition-in-filter-for-xml/127055/20 "2018-05-07T07:38:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.