# How to remove the root element while xml parsing using Logstash?

**URL:** <https://discuss.elastic.co/t/how-to-remove-the-root-element-while-xml-parsing-using-logstash/209412>\
**Category:** Logstash\
**Created:** [November 26, 2019, 4:47am UTC](https://discuss.elastic.co/t/how-to-remove-the-root-element-while-xml-parsing-using-logstash/209412 "2019-11-26T04:47:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Reshmi](https://avatars.discourse-cdn.com/v4/letter/r/87869e/32.png) [@Reshmi](https://discuss.elastic.co/u/Reshmi)\
**Post date:** [November 26, 2019, 4:47am UTC](https://discuss.elastic.co/t/how-to-remove-the-root-element-while-xml-parsing-using-logstash/209412/1 "2019-11-26T04:47:30Z")

</div>

My sample XML structure is as below:

```
  <Order BillToID="123">
  <PersonInfo Address="abc"></PersonInfo>
  <OrderLines>
  <OrderLine DeliveryMethod="xyz"></OrderLine>
  </OrderLines>
  </Order>

```

With the below code:

```
   xml {
		source => "message"
		store_xml => true
		target => "order"
		force_array => false
	}

```

I can achieve something like this:

Output Received in Elastic  
"hits": [  
{  
"\_index": "order",  
"\_type": "order",  
"\_id": "123",  
"\_score": 1,  
"\_source": {  
"order": {  
"BillToID": "123",  
"PersonInfo": {  
"ShipNode": "53"  
}  
"OrderLines": {  
"OrderLine" : [  
{  
"DeliveryMethod": "xyz"  
}  
]  
}  
}  
]

In the above output all the elements and attributes are coming under "order" object as I have specified target as "order".  
Is there any way to take all the elements and attributes out of "order" without using xpath. With xpath I could able to achieve this by parsing every element and attributes with its path. But my xml is huge and I would like to avoid using xpath.

Basically I would like to have the output like below:

Expected Output:  
"hits": [  
{  
"\_index": "order",  
"\_type": "order",  
"\_id": "123",  
"\_score": 1,  
"\_source": {  
"BillToID": "123",  
"PersonInfo": {  
"ShipNode": "53"  
}  
"OrderLines": {  
"OrderLine" : [  
{  
"DeliveryMethod": "xyz"  
}  
]  
}  
]

Any help would be much appreciated.`Preformatted text`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 26, 2019, 1:43pm UTC](https://discuss.elastic.co/t/how-to-remove-the-root-element-while-xml-parsing-using-logstash/209412/2 "2019-11-26T13:43:26Z")

</div>

Take a look at [this](https://discuss.elastic.co/t/how-to-dynamically-move-nested-key-value-to-root-level/180006/2).

---

<div class="post-metadata">

**Author:** ![Reshmi](https://avatars.discourse-cdn.com/v4/letter/r/87869e/32.png) [@Reshmi](https://discuss.elastic.co/u/Reshmi)\
**Post date:** [November 27, 2019, 6:13am UTC](https://discuss.elastic.co/t/how-to-remove-the-root-element-while-xml-parsing-using-logstash/209412/3 "2019-11-27T06:13:10Z")

</div>

Thanks Badger. Your solution worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 25, 2019, 6:13am UTC](https://discuss.elastic.co/t/how-to-remove-the-root-element-while-xml-parsing-using-logstash/209412/4 "2019-12-25T06:13:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.