How to extract field name which has space in them using xpath

I have following xml code

xml {
       source => "message"
        store_xml => "false"
      remove_namespaces =>  "true"
      xpath => [
          '/E2ETraceEvent/System/Computer/text()', "[grc][System][Computer]",
          '/E2ETraceEvent/System/Correlation/text()', "[grc][System][Correlation]",
          '/E2ETraceEvent/System/`Source Name`/text()', "[grc][System][Source]"
But it fails when I have space in my xml field name

<E2ETraceEvent xmlns="">
    <System xmlns="">
        <SubType Name="Error">0</SubType>
        <TimeCreated SystemTime="2020-10-21T04:47:38.0146329Z" />
        <Source Name="Archer.Web" />
        <Correlation ActivityID="{00000000-0000-0000-0000-000000000000}" />
        <Execution ProcessName="w3wp" ProcessID="6884" ThreadID="226" />
        <Assembly Version>6.7.300.1039</AssemblyVersion>
        <Channel />

How do I extract fields with space in them such as
SubType Name
TimeCreated SystemTime
xpath extracts Compter just fine.

That is not what you have. XML element names cannot contain spaces. You have a Source element that has a Name attribute.

<Assembly Version>6.7.300.1039</AssemblyVersion>

Note that you have an extra space in Assembly Version that causes the xml filter to silently fail. If you fix that then you can use

    xml {
        source => "message"
        store_xml => false
        remove_namespaces => true
        xpath => {
            "/E2ETraceEvent/System/Computer/text()" => "[grc][System][Computer]"
            "/E2ETraceEvent/System/Correlation/text()" => "[grc][System][Correlation]"
            "/E2ETraceEvent/System/Source/@Name" => "[grc][System][Source]"

to get yourself

       "grc" => {
    "System" => {
          "Source" => [
            [0] "Archer.Web"
        "Computer" => [
            [0] "ABCXYZ"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.