# Issue while parsing xml data from a file

**URL:** <https://discuss.elastic.co/t/issue-while-parsing-xml-data-from-a-file/225132>\
**Category:** Logstash\
**Created:** [March 26, 2020, 7:24am UTC](https://discuss.elastic.co/t/issue-while-parsing-xml-data-from-a-file/225132 "2020-03-26T07:24:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Varun\_Saraf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varun_saraf/32/62182_2.png) [@Varun\_Saraf](https://discuss.elastic.co/u/Varun_Saraf)\
**Post date:** [March 26, 2020, 7:24am UTC](https://discuss.elastic.co/t/issue-while-parsing-xml-data-from-a-file/225132/1 "2020-03-26T07:24:19Z")

</div>

I have xml data in a file and I am trying to parse it as a single event and visualise it in kibana  
below is the Configuration file for logstash.  
input {  
file {  
path =\> "/Users/varsaraf/outxr.xml"  
start\_position =\> "beginning"  
sincedb\_path =\> "/tmp/sincedbfile"  
exclude =\> "\*.gz"  
type =\> "xml"  
codec =\> multiline {  
pattern =\> "\<operation-data"  
negate =\> "true"  
what =\> "previous"  
}  
}  
}

```
filter {
    xml {
        source => "message"
        store_xml => false
        target => "doc"
        xpath => [
            "/operation-data/operations/operation/operation-id/text()", "oper-id",
            "/operation-data/operations/operation/operation-time/text()", "oper-time",
            "/operation-data/operations/operation/statistics/specific-stats/icmp-path-jitter-stats/source-address/text()", "source-ip",
            "/operation-data/operations/operation/statistics/specific-stats/icmp-path-jitter-stats/dest-address/text()", "dest-ip",
            "/operation-data/operations/operation/statistics/specific-stats/icmp-path-jitter-stats/hop-address/text()", "hop-id",
            "/operation-data/operations/operation/statistics/specific-stats/icmp-path-jitter-stats/packet-interval/text()", "pkt-interval",
            "/operation-data/operations/operation/statistics/specific-stats/icmp-path-jitter-stats/response-time-count/text()", "RTC",
            "/operation-data/operations/operation/statistics/specific-stats/icmp-path-jitter-stats/packet-count/text()", "pkts",
            "/operation-data/operations/operation/statistics/specific-stats/icmp-path-jitter-stats/packet-loss-count/text()", "pkt-loss"
        ]
    }
}

output {
    elasticsearch {
        codec => json
        hosts => ["localhost:9200"]
        index => "test1"
    }
    stdout {
        codec => rubydebug
    }

```

I am able to create an index but the fields have data type as string I want them to be long or integer. how do I do it?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 26, 2020, 5:18pm UTC](https://discuss.elastic.co/t/issue-while-parsing-xml-data-from-a-file/225132/2 "2020-03-26T17:18:30Z")

</div>

> [@Varun\_Saraf](#):
>
> I am able to create an index but the fields have data type as string I want them to be long or integer.

You could use mutate+convert. You will need to create a new index to see the type change.

---

<div class="post-metadata">

**Author:** ![Varun\_Saraf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varun_saraf/32/62182_2.png) [@Varun\_Saraf](https://discuss.elastic.co/u/Varun_Saraf)\
**Post date:** [March 27, 2020, 10:24am UTC](https://discuss.elastic.co/t/issue-while-parsing-xml-data-from-a-file/225132/3 "2020-03-27T10:24:41Z")

</div>

I get the following output on running the new config file with the corrections of adding mutate and convert. the output is attached as Screenshot-

 ![Screenshot 2020-03-27 at 3.42.14 PM](https://us1.discourse-cdn.com/elastic/original/3X/9/1/914c0b18c271ad047c014d5291d0d865d35bd08e.jpeg)

my config file is -

```
    input {
       file {
    path => "/Users/varsaraf/out.xml" start_position => "beginning"
    sincedb_path => "/tmp/mysincedbfilez"
    exclude => "*.gz"
    type => "xml"
    codec => multiline {
        pattern => "<sla-path-jitter-stats>"
        negate => "true"
        what => "previous"
    }
}} filter {
xml {
    source => "message"
    store_xml => false
    target => "sla-path-jitter-stats"
    xpath => [
        "/sla-path-jitter-stats/oper-id/text()", "id",
        "/sla-path-jitter-stats/hop-address/text()", "ip_address",
        "/sla-path-jitter-stats/latest-start-time/text()", "start-time",
        "/sla-path-jitter-stats/latest-rtt-stats/sum-of-rtt/text()", "rtt-sum",
        "/sla-path-jitter-stats/latest-packet-loss-stats/timeouts/text()", "timeout",
        "/sla-path-jitter-stats/latest-packet-loss-stats/packet-loss-count/text()", "packet-loss"
    ]} mutate {convert => {"id" => "long" "rtt-sum" => "long" "timeout" => "long" "packet-loss"=>"long"

```

} }}  
output {  
elasticsearch {  
codec =\> json  
hosts =\> ["localhost:9200"]  
index =\> "ipslaxe"  
}  
stdout {  
codec =\> rubydebug  
}}

it doesn't create an index or send the data to Elasticsearch. while previously the same file without mutate and convert was sending the data.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 27, 2020, 3:57pm UTC](https://discuss.elastic.co/t/issue-while-parsing-xml-data-from-a-file/225132/4 "2020-03-27T15:57:04Z")

</div>

> [@Varun\_Saraf](#):
>
> "timeout" =\> "long"

"long" is not a supported type. Read the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-convert).

---

<div class="post-metadata">

**Author:** ![Varun\_Saraf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varun_saraf/32/62182_2.png) [@Varun\_Saraf](https://discuss.elastic.co/u/Varun_Saraf)\
**Post date:** [March 30, 2020, 6:06am UTC](https://discuss.elastic.co/t/issue-while-parsing-xml-data-from-a-file/225132/5 "2020-03-30T06:06:49Z")

</div>

I have changed the config file still it shows no output. attaching the config file below.

```
input {
    file {
        path => "/Users/varsaraf/out.xml"
        start_position => "beginning"
        sincedb_path => "/tmp/mysincedbfilez"
        exclude => "*.gz"
        type => "xml"
        codec => multiline {
            pattern => "<sla-path-jitter-stats>"
            negate => "true"
            what => "previous"
        }
    }
}

filter {
    xml {
        source => "message"
        store_xml => false
        target => "sla-path-jitter-stats"
        xpath => [
            "/sla-path-jitter-stats/oper-id/text()", "id",
            "/sla-path-jitter-stats/hop-address/text()", "ip_address",
            "/sla-path-jitter-stats/latest-start-time/text()", "start-time",
            "/sla-path-jitter-stats/latest-rtt-stats/sum-of-rtt/text()", "rtt-sum",
            "/sla-path-jitter-stats/latest-packet-loss-stats/timeouts/text()", "timeout",
            "/sla-path-jitter-stats/latest-packet-loss-stats/packet-loss-count/text()", "packet-loss"
        ]
    }
}
filter{
 mutate {
 convert => {
   "id" => "integer"
   "rtt-sum" => "integer"
   "timeout" => "integer"
   "packet-loss" => "integer"
   }
 }
}
output {
    elasticsearch {
        codec => json
        hosts => ["localhost:9200"]
        index => "ipslaxe"
    } }
    stdout {
        codec => rubydebug
    }
}

```

what is the error ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2020, 6:06am UTC](https://discuss.elastic.co/t/issue-while-parsing-xml-data-from-a-file/225132/6 "2020-04-27T06:06:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.