# Keep order of xml in Logstash

**URL:** <https://discuss.elastic.co/t/keep-order-of-xml-in-logstash/247831>\
**Category:** Logstash\
**Created:** [September 8, 2020, 7:25am UTC](https://discuss.elastic.co/t/keep-order-of-xml-in-logstash/247831 "2020-09-08T07:25:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![\_Louw](https://avatars.discourse-cdn.com/v4/letter/_/ee7513/32.png) [@\_Louw](https://discuss.elastic.co/u/_Louw)\
**Post date:** [September 8, 2020, 7:25am UTC](https://discuss.elastic.co/t/keep-order-of-xml-in-logstash/247831/1 "2020-09-08T07:25:03Z")

</div>

I am parsing XML-input in Logstash, and I need to keep the sorting of it, as it is relevant.  
Example xml:

```auto
<log>
<trace id="77">
    <event id="Activity1" timestamp="2020-09-04T08:39:09.210" />
    <advance delta="P1D" timestamp="2020-09-04T08:39:36.583" />
    <event id="Activity0" timestamp="2020-09-04T08:39:42.593" />
</trace>
</log>

```

I get the data via the http filter in the filter{} part of my script, but when I transform it to xml using

```auto
xml {
    source => "body"
    target => "dcrsims"
}

```

the sorting is forgotten, and everything is sorted into tags instead, so I have an "event" part and an "advance" part - the internal sorting is kept, but I can't know when an advance comes in between two events.

The xml transform is making my further code so much easier, so is there a way to keep the ordering of the elements?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2020, 7:25am UTC](https://discuss.elastic.co/t/keep-order-of-xml-in-logstash/247831/2 "2020-10-06T07:25:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.