# How extract data with logstash filter xml from a complex xml

**URL:** <https://discuss.elastic.co/t/how-extract-data-with-logstash-filter-xml-from-a-complex-xml/205905>\
**Category:** Logstash\
**Created:** [October 30, 2019, 4:06pm UTC](https://discuss.elastic.co/t/how-extract-data-with-logstash-filter-xml-from-a-complex-xml/205905 "2019-10-30T16:06:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Leandro1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro1/32/47870_2.png) [@Leandro1](https://discuss.elastic.co/u/Leandro1)\
**Post date:** [October 30, 2019, 4:06pm UTC](https://discuss.elastic.co/t/how-extract-data-with-logstash-filter-xml-from-a-complex-xml/205905/1 "2019-10-30T16:06:38Z")

</div>

Hello, I need to extract the data returned from an xml in an http input

The xml Returned is:

```
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<model-response-list xmlns="http://www.example.com" total-models="1" throttle="1" error="EndOfResults">
    <model-responses>
        <model xx="0x12345">
            <attribute id="0x1212e">FIELD I WANT</attribute>
            <attribute id="0x1219f">FIELD I WANT</attribute>
            <attribute id="0x23454">FIELD I WANT</attribute>
            <attribute-list id="0x12zaq">
                <instance oid="2" value="11"/>
            </attribute-list>
            <attribute-list id="0x12ac6">
                <instance oid="1" value="65"/>
                <instance oid="14" value="100"/>
            </attribute-list>
        </model>
    </model-responses>
</model-response-list>

```

In addition to these fields, I need the values ​​of these

oid="2" value="11"  
oid="14" value="100"

My logstash conf is:

```
input{
http_poller{
        urls => {
                urlname => "http://192.168.56.101:8081/request"
        }
        request_timeout => 60
        schedule => {every => "3s"}
        codec => line
 }
}

filter {
        xml {
           store_xml => false
           source => "message"
           remove_namespaces => true
           xpath =>["/model-response-list/model-responses/model/attribute", "FIELDRETRIEVEONE"]

        
}
}
output{
elasticsearch{
        hosts => ["192.168.56.102:9200"]
        index => "logstash_http_poller"
}
stdout { codec => rubydebug }
}

```

I can get the first value, but the next I couldn't. Can anybody help me?  
Thank you very much!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 30, 2019, 4:23pm UTC](https://discuss.elastic.co/t/how-extract-data-with-logstash-filter-xml-from-a-complex-xml/205905/2 "2019-10-30T16:23:33Z")

</div>

Please do not post pictures of text, just post the text.

---

<div class="post-metadata">

**Author:** ![Leandro1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro1/32/47870_2.png) [@Leandro1](https://discuss.elastic.co/u/Leandro1)\
**Post date:** [November 1, 2019, 5:17pm UTC](https://discuss.elastic.co/t/how-extract-data-with-logstash-filter-xml-from-a-complex-xml/205905/3 "2019-11-01T17:17:13Z")

</div>

I solved my problem forcing the response be a json file

```
headers => {
			Accept => "application/json"
		}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 29, 2019, 5:17pm UTC](https://discuss.elastic.co/t/how-extract-data-with-logstash-filter-xml-from-a-complex-xml/205905/4 "2019-11-29T17:17:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.