# How to pass selected fileds from an XML source to a file/message **URL:** \ **Category:** Logstash\ **Created:** [June 14, 2018, 2:32pm UTC](https://discuss.elastic.co/t/how-to-pass-selected-fileds-from-an-xml-source-to-a-file-message/135943 "2018-06-14T14:32:22Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![FBRA](https://avatars.discourse-cdn.com/v4/letter/f/f9ae1b/32.png) [@FBRA](https://discuss.elastic.co/u/FBRA)\ **Post date:** [June 14, 2018, 2:32pm UTC](https://discuss.elastic.co/t/how-to-pass-selected-fileds-from-an-xml-source-to-a-file-message/135943/1 "2018-06-14T14:32:22Z")
I'm parsing an XML file and would like to create message from some of the fields: Here is the part from the config file: filter { xml { source =\> "inxml" store\_xml =\> true target =\> "message" xpath =\> [ "/QMGRDEFS/QMGR/NAME/text()", "Name", "/QMGRDEFS/QMGR/DEADQ/text()", "DeadQ", "/QMGRDEFS/QMGR/DESCR/text()", "DESCR", "/QMGRDEFS/QMGR/PLATFORM/text()", "Platform", "/QMGRDEFS/QMGR/CMDLEVEL/text()", "CMDlevel" ] } mutate { add\_field =\> [ "message", "%{Name} %{DeadQ} %{DESCR} %{Platform} %{CMDlevel}" ] } } output { stdout {} file { path =\> "E:\Logstash\working\qmgr.xml" Any idea? Thanks a lot, Feli ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 14, 2018, 2:39pm UTC](https://discuss.elastic.co/t/how-to-pass-selected-fileds-from-an-xml-source-to-a-file-message/135943/2 "2018-06-14T14:39:40Z")
And in what way is your current configuration unsatifactory? ---
**Author:** ![FBRA](https://avatars.discourse-cdn.com/v4/letter/f/f9ae1b/32.png) [@FBRA](https://discuss.elastic.co/u/FBRA)\ **Post date:** [June 14, 2018, 2:41pm UTC](https://discuss.elastic.co/t/how-to-pass-selected-fileds-from-an-xml-source-to-a-file-message/135943/3 "2018-06-14T14:41:53Z")
Hi, I'm new to logstash it doesn't get the content of the Xpaths to the file. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 14, 2018, 6:50pm UTC](https://discuss.elastic.co/t/how-to-pass-selected-fileds-from-an-xml-source-to-a-file-message/135943/4 "2018-06-14T18:50:52Z")
To save everyone time and frustration, please spend more time describing the problem. - What does your Logstash input plugin configuration look like? - What does the input file itself look like? - What are you currently getting from Logstash? Copy/paste from qmgr.xml. - What would you like to get instead? ---
**Author:** ![FBRA](https://avatars.discourse-cdn.com/v4/letter/f/f9ae1b/32.png) [@FBRA](https://discuss.elastic.co/u/FBRA)\ **Post date:** [June 15, 2018, 7:15am UTC](https://discuss.elastic.co/t/how-to-pass-selected-fileds-from-an-xml-source-to-a-file-message/135943/5 "2018-06-15T07:15:28Z")
Hi Mahnus, it is a XML containing the definit8ion of a IBM MQ QMgr. \ LULU2226DISABLED1800OFFOFFMSGDISABLED850DISABLEDDISABLED DISABLED 100999999999LOCAL800SYSTEM.ADMIN.COMMAND.QUEUE2018-04-0914.34.31MQDL.LULU2226.01 Win QMGRYESDISABLEDIPV4DISABLEDDISABLED500025667109508NOLIMIT910000QMGROFFOFF DISABLEDWINDOWSNTENABLEDDISCARDNORMAL5IFPERLULU2226\_2018-04-09\_14.34.31LULU2226DISABLED MSGQMGRQMGR DISABLEDNOE:\MQMDaten\qmgrs\LULU2226\ssl\key0QMGROFF1800OFFOFFENABLED1800999999999 That's on the console: E:\Logstash\logstash-6.2.4\>bin\logstash -f ..\working\configs\XML\_QMGR\_XPATH.conf Sending Logstash's logs to E:/Logstash/logstash-6.2.4/logs which is now configured via log4j2.properties [2018-06-15T09:11:51,331][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"fb\_apache", :directory=\>"E:/Logstash /logstash-6.2.4/modules/fb\_apache/configuration"} [2018-06-15T09:11:51,347][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"netflow", :directory=\>"E:/Logstash/l ogstash-6.2.4/modules/netflow/configuration"} [2018-06-15T09:11:51,643][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command lin e options are specified [2018-06-15T09:11:52,361][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.2.4"} [2018-06-15T09:11:55,107][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2018-06-15T09:11:56,885][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>1, "pipelin e.batch.size"=\>125, "pipeline.batch.delay"=\>50} [2018-06-15T09:12:02,017][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\"} [2018-06-15T09:12:02,080][INFO][logstash.agent] Pipelines running {:count=\>1, :pipelines=\>["main"]} { "host" =\> "SVM1298", "@timestamp" =\> 2018-06-15T07:12:02.142Z, "message" =\> [ [0] "\\r", [1] "%{Name} %{DeadQ} %{DESCR} %{Platform} %{CMDlevel}" ], "@version" =\> "1", "type" =\> "xml", "path" =\> "E:\Logstash\working\LULU2226.xml" } { "host" =\> "SVM1298", "@timestamp" =\> 2018-06-15T07:12:02.189Z, "message" =\> [ [0] "\r", [1] "%{Name} %{DeadQ} %{DESCR} %{Platform} %{CMDlevel}" ], "@version" =\> "1", "type" =\> "xml", "path" =\> "E:\Logstash\working\LULU2226.xml" } [2018-06-15T09:12:03,000][INFO][logstash.outputs.file] Opening file {:path=\>"E:/Logstash/working/qmgr.xml"} this is in the Output file: {"host":"OLA1298","@timestamp":"2018-06-15T07:12:02.142Z","message":["\\r","%{Name} %{DeadQ} %{DESCR} %{Platform} %{CMDlevel}"],"@version":"1","type":"xml","path":"E:\Logstash\working\LULU2226.xml"} {"host":"OLA1298","@timestamp":"2018-06-15T07:12:02.189Z","message":["\r","%{Name} %{DeadQ} %{DESCR} %{Platform} %{CMDlevel}"],"@version":"1","type":"xml","path":"E:\Logstash\working\LULU2226.xml"} Thanks Feli ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 15, 2018, 7:30am UTC](https://discuss.elastic.co/t/how-to-pass-selected-fileds-from-an-xml-source-to-a-file-message/135943/6 "2018-06-15T07:30:07Z")
To avoid getting your files and logs garbled format them as preformatted text using Markdown notation or the `` toolbar button. ---
**Author:** ![FBRA](https://avatars.discourse-cdn.com/v4/letter/f/f9ae1b/32.png) [@FBRA](https://discuss.elastic.co/u/FBRA)\ **Post date:** [June 15, 2018, 7:52am UTC](https://discuss.elastic.co/t/how-to-pass-selected-fileds-from-an-xml-source-to-a-file-message/135943/7 "2018-06-15T07:52:19Z")
Hi Magnus, I think this is due to copying it on your Website. on the logstash Server it Looks like a normal XML file. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 15, 2018, 8:00am UTC](https://discuss.elastic.co/t/how-to-pass-selected-fileds-from-an-xml-source-to-a-file-message/135943/8 "2018-06-15T08:00:55Z")
Yes, of course it looks fine on the Logstash server but if I'm going to help I only care about what I can see. So I repeat: To avoid getting your files and logs garbled format them as preformatted text using Markdown notation or the `` toolbar button. ---
**Author:** ![FBRA](https://avatars.discourse-cdn.com/v4/letter/f/f9ae1b/32.png) [@FBRA](https://discuss.elastic.co/u/FBRA)\ **Post date:** [June 15, 2018, 8:22am UTC](https://discuss.elastic.co/t/how-to-pass-selected-fileds-from-an-xml-source-to-a-file-message/135943/9 "2018-06-15T08:22:32Z")
Magnus, how can I upload a file? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 13, 2018, 8:22am UTC](https://discuss.elastic.co/t/how-to-pass-selected-fileds-from-an-xml-source-to-a-file-message/135943/10 "2018-07-13T08:22:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.