# How to split and filtring xml in LogStash

**URL:** <https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065>\
**Category:** Logstash\
**Created:** [June 20, 2017, 9:07am UTC](https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065 "2017-06-20T09:07:22Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohammed\_cherif](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mohammed\_cherif](https://discuss.elastic.co/u/mohammed_cherif)\
**Post date:** [June 20, 2017, 9:07am UTC](https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065/1 "2017-06-20T09:07:22Z")

</div>

I have the following logstash conf file:

```
input {
     file {
          path => "C:/logstash/data/test.xml"
          start_position => beginning
          codec => multiline
          {
           pattern => "^<\?providerConfigResponse .*\>"
           negate => true
           what => "previous"
          }
     }

    filter {
          xml {
           store_xml => false
           source => "message"
           xpath =>
           [
            "/providerConfigResponse//svgconfig", "svConfig",
            "/providerConfigResponse//svgconfig//function","function"

           ]
        }
    }

    output {
    elasticsearch {
        index => "xmltest"
        document_type => "xmlfiles"
        hosts => "localhost:9200"
    }

    stdout { codec => json }

```

and my file xml :

```
<providerConfigResponse>
<svgconfig>
    <name>SVG1</name>
    <function>
        test 1
    </function> 
    <function>
        test 2
    </function> 
</svgconfig>
<svgconfig>
    <name>SVG2</name>
    <function>
    test 3
    </function> 
</svgconfig>
<svgconfig>
    <name>SVG3</name>
    <function>
    test 4
    </function> 
    <function>
    test 5
    </function> 
</svgconfig>
</providerConfigResponse>

```

and i want to have ouput json liks this :

```
 {

    "svgconfig" : [function: test 1, function: test 2],
    "svgconfig" : test 3,
   " svgconfig" : [function: test 4, function: test 5]

    }

```

But with my config i don't have what i want

I use logstash v5.4.0 and elasticsearch v5.4.0

Any solution ?

thanks

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [June 20, 2017, 9:36am UTC](https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065/2 "2017-06-20T09:36:01Z")

</div>

```auto
 {
    "svgconfig" : [function: test 1, function: test 2],
    "svgconfig" : test 3,
    "svgconfig" : [function: test 4, function: test 5]
  }

```

This isn't really possible in JSON as it is a object and so the keys must be unique (in your example you have 3 `svgconfig` keys). also you want that, if there's only one function block, that there is no array and just the value? that complicates things 😕

---

<div class="post-metadata">

**Author:** ![mohammed\_cherif](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mohammed\_cherif](https://discuss.elastic.co/u/mohammed_cherif)\
**Post date:** [June 20, 2017, 10:38am UTC](https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065/3 "2017-06-20T10:38:57Z")

</div>

Ok thank's. I want get list of `svgconfig` and for each item i get list of function to visualise it in Kibanna.

How i can do it ?

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [June 20, 2017, 10:54am UTC](https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065/4 "2017-06-20T10:54:28Z")

</div>

what kind of vizualization would you like? how many   
blocks does each file have?

Do you just want to plot the values of the functions? do they have to be grouped by svgconfig block? if so, how do you want them grouped?

---

<div class="post-metadata">

**Author:** ![mohammed\_cherif](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mohammed\_cherif](https://discuss.elastic.co/u/mohammed_cherif)\
**Post date:** [June 20, 2017, 11:00am UTC](https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065/5 "2017-06-20T11:00:53Z")

</div>

i want group the value of function by `svgconfig` .  
for example the svgconfig with name 'SVG1' i have 3 functions (test1, test2 and test 3).  
i edit my file xml, now is copmlet

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [June 20, 2017, 11:05am UTC](https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065/6 "2017-06-20T11:05:30Z")

</div>

ok so we have:

```auto
SVG1
   test 1
   test 2
SVG2
   test 3
SVG3
   test 4
   test 5

```

What kind of vizualization are you thinking about? if it was a line chart, what would be the x-axis and the y-axis?

---

<div class="post-metadata">

**Author:** ![mohammed\_cherif](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mohammed\_cherif](https://discuss.elastic.co/u/mohammed_cherif)\
**Post date:** [June 20, 2017, 11:25am UTC](https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065/7 "2017-06-20T11:25:08Z")

</div>

Vertical Bar. for y-axis : **count** and x-axis :

1. aggregation term by [svgconfig]/[name]
2. Split Series : aggregation term by [function]

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [June 20, 2017, 11:53am UTC](https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065/8 "2017-06-20T11:53:01Z")

</div>

I'm not very well versed with elasticsearch, but I think that, for that purpose, you need to send each function in a separate event, so

```auto
SVG1, test 1
SVG1, test 2
SVG2, test 3
SVG3, test 4
SVG3, test 5

```

I'm not sure how to do this in xpath as I'm not an expert, maybe chain two xml filters, one that breaks each svgconfig, then one that breaks each function

---

<div class="post-metadata">

**Author:** ![mohammed\_cherif](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mohammed\_cherif](https://discuss.elastic.co/u/mohammed_cherif)\
**Post date:** [June 20, 2017, 1:51pm UTC](https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065/9 "2017-06-20T13:51:03Z")

</div>

thank's, I will test it, and I come back to you 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2017, 1:51pm UTC](https://discuss.elastic.co/t/how-to-split-and-filtring-xml-in-logstash/90065/10 "2017-07-18T13:51:26Z")

</div>

Closed on July 18, 2017, 1:51pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.