# How ot deal with empty field in xml parser?

**URL:** <https://discuss.elastic.co/t/how-ot-deal-with-empty-field-in-xml-parser/217250>\
**Category:** Logstash\
**Created:** [January 30, 2020, 5:18pm UTC](https://discuss.elastic.co/t/how-ot-deal-with-empty-field-in-xml-parser/217250 "2020-01-30T17:18:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rajsolanki](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajsolanki/32/86859_2.png) [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\
**Post date:** [January 30, 2020, 5:18pm UTC](https://discuss.elastic.co/t/how-ot-deal-with-empty-field-in-xml-parser/217250/1 "2020-01-30T17:18:34Z")

</div>

i m sorry if this is repeat question. I m struggling with xml having empty values.

I m using logstash 7.5.1 XML filter. Here is my config.

```
##Input section

input
{
    file
        {
            path => "/tmp/test.xml"
            start_position => "beginning"
            sincedb_path => "/dev/null"
            type => "xml"
            codec => multiline {
                    pattern => "<?xml "
                    negate => "true"
                    what => "previous"
                }
        }
}

##Filter section

filter {

    xml{
        source => "message"
        store_xml => false
        target => "root"
        xpath => [
            "/root/fname/text()", "FName",
            "/root/lname/text()", "LName",
            "/root/age/text()", "Age",
            "/root/exp/text()", "Exp"
        ]
    }

     mutate {
            replace => [
                  "FName" , "%{[FName][0]}",
                  "LName" , "%{[LName][0]}",
                  "Age" , "%{[Age][0]}",
                  "Exp" , "%{[Exp][0]}"
                  ]
        }

}

##Output section
output {

stdout
        {
           codec => rubydebug
        }
}

```

Here is my XML

```
<?xml version="1.0" encoding="UTF-8"?>
<root>
    <fname>raj</fname>
    <lname>solanki</lname>
    <age>001</age>
    <exp>9</exp>
</root>

```

~

here is my output

```
{
          "type" => "xml",
    "@timestamp" => 2020-01-30T17:12:43.186Z,
          "tags" => [
        [0] "multiline"
    ],
       "message" => "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<root>\n <fname>raj</fname>\n <lname>solanki</lname>\n <age>001</age>\n <exp>9</exp>\n</root>",
           "Age" => "001",
           "Exp" => "9",
          "path" => "/tmp/test.xml",
      "@version" => "1",
         "FName" => "raj",
         "LName" => "solanki"
}

```

Now if i have document which doesn't have any values i.e no value for Exp

```
<?xml version="1.0" encoding="UTF-8"?>
<root>
    <fname>raj</fname>
    <lname>solanki</lname>
    <age>001</age>
    <exp></exp>
</root>

```

output

```
{
           **"Exp" => "%{[Exp][0]}",**
         "FName" => "raj",
         "LName" => "solanki",
       "message" => "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<root>\n <fname>raj</fname>\n <lname>solanki</lname>\n <age>001</age>\n <exp></exp>\n</root>",
           "Age" => "001",
          "path" => "/tmp/test.xml",
          "tags" => [
        [0] "multiline"
    ],
    "@timestamp" => 2020-01-30T17:15:53.099Z,

      "@version" => "1",
          "type" => "xml"
}

```

so how to assign value only if element has a value ? I did try

if [Exp][0] {}  
and if [Exp][0] != "" {}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 30, 2020, 6:35pm UTC](https://discuss.elastic.co/t/how-ot-deal-with-empty-field-in-xml-parser/217250/2 "2020-01-30T18:35:46Z")

</div>

If the element is empty then it does not add a field to the event. So you just check if the field exists before doing the replacement

```
if [FName] { mutate { replace => { "FName" => "%{[FName][0]}" } } }
if [LName] { mutate { replace => { "LName" => "%{[LName][0]}" } } }
if [Age] { mutate { replace => { "Age" => "%{[Age][0]}" } } }
if [Exp] { mutate { replace => { "Exp" => "%{[Exp][0]}" } } }
```

---

<div class="post-metadata">

**Author:** ![rajsolanki](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajsolanki/32/86859_2.png) [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\
**Post date:** [January 30, 2020, 6:54pm UTC](https://discuss.elastic.co/t/how-ot-deal-with-empty-field-in-xml-parser/217250/3 "2020-01-30T18:54:18Z")

</div>

thanks a lot !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2020, 6:54pm UTC](https://discuss.elastic.co/t/how-ot-deal-with-empty-field-in-xml-parser/217250/4 "2020-02-27T18:54:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.