# Inconsistent XML - Conditional fields check

**URL:** <https://discuss.elastic.co/t/inconsistent-xml-conditional-fields-check/154588>\
**Category:** Logstash\
**Created:** [October 30, 2018, 8:55am UTC](https://discuss.elastic.co/t/inconsistent-xml-conditional-fields-check/154588 "2018-10-30T08:55:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrncgirc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrncgirc/32/45055_2.png) [@mrncgirc](https://discuss.elastic.co/u/mrncgirc)\
**Post date:** [October 30, 2018, 8:55am UTC](https://discuss.elastic.co/t/inconsistent-xml-conditional-fields-check/154588/1 "2018-10-30T08:55:34Z")

</div>

Hi,

I am importing an XML file from an external provider. The XML has many inconsistencies. Often fields vary. This means that I often index fields with incorrect data (I index the mapping expression).

I would like to be able to exclude some fields in case they are not presented in the XML and for other fields I want to insert a default value.

Example of field indexed with the mapping expression:  
"registrationTypeId": "%{[registrationTypeId][0]}",  
Preferred default value: 0

"efficiency": "%{[efficiency][0]}",  
Preferred default value: 0

I have attempted to understand how to apply the conditional and drop from this thread, for the fields I wish to drop entirely: [Conditional for empty string in field](https://discuss.elastic.co/t/conditional-for-empty-string-in-field/77182) but it dont see where to apply it and how to treat it in the replace of mutate. Likewise with updating a fields value to a default value incase the value is not returned from the xpath.

My filter looks like this:

```
filter {
xml {
    #target => "doc"
    source => "message"
    store_xml => "false"
    xpath => ["//Statistik","statistic"]
    remove_namespaces => true
}

mutate {
    remove_field => ["message", "inxml", "xmldata"]
}

split {
    field => "statistic"
}

xml {
    source => "statistic"
    store_xml => "false"
    ...
    xpath => ["//Statistik/KoeretoejOplysningGrundStruktur/KoeretoejOplysningTypeAnmeldelseNummer/text()","registrationTypeId"]
    xpath => ["//Statistik/KoeretoejOplysningGrundStruktur/KoeretoejMotorStruktur/KoeretoejMotorKmPerLiter/text()","efficiency"]
    ...
}
mutate {
    replace => {
    	...
        "[vehicle][registrationTypeId]" => "%{[registrationTypeId][0]}"
        "[vehicle][efficiency]" => "%{[efficiency][0]}"
        ...
    }
}

mutate {
    ...
    remove_field => ["statistic"]
    remove_field => ["registrationTypeId"]
    remove_field => ["efficiency"]
    ...
}
}
```

---

<div class="post-metadata">

**Author:** ![mrncgirc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrncgirc/32/45055_2.png) [@mrncgirc](https://discuss.elastic.co/u/mrncgirc)\
**Post date:** [October 30, 2018, 9:22am UTC](https://discuss.elastic.co/t/inconsistent-xml-conditional-fields-check/154588/2 "2018-10-30T09:22:21Z")

</div>

I solved this by doing an if condition within filter, but outside mutate.

```
    if ![efficiency] {
        mutate {
            replace => {
                "[vehicle][efficiency]" => "Hello WOrld"
            }
        }
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2018, 9:22am UTC](https://discuss.elastic.co/t/inconsistent-xml-conditional-fields-check/154588/3 "2018-11-27T09:22:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.