# Logstash - Parse XML attributes

**URL:** <https://discuss.elastic.co/t/logstash-parse-xml-attributes/145029>\
**Category:** Logstash\
**Created:** [August 18, 2018, 11:28pm UTC](https://discuss.elastic.co/t/logstash-parse-xml-attributes/145029 "2018-08-18T23:28:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ju\_La](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@Ju\_La](https://discuss.elastic.co/u/Ju_La)\
**Post date:** [August 18, 2018, 11:28pm UTC](https://discuss.elastic.co/t/logstash-parse-xml-attributes/145029/1 "2018-08-18T23:28:37Z")

</div>

I am trying to parse and send field names to ElasticSearch and am running into issue with getting the correct fields lined up.

Here is some sample XML

```
<products>
<product name="name_1"></product>
<product name="name_2"></product>
<product name="name_3"></product>
</products>

```

My logstash config file:

```
input {
    file {
        path => "sample.xml"
        start_position => "beginning"
        sincedb_path => "/dev/null"
        exclude => "*.gz"
        type => "xml"
        codec => multiline {
            pattern => "<products>"
            negate => "true"
            what => "previous"
        }
    }
}

filter {
    xml {
        source => "message"
        store_xml => false
        target => "products"
        add_field => {
            "p_name" => "%{[products][product][name]}"
        }
        xpath => [
            "/products/*/@name", "product_name"
        ]
    }
}

```

Currently, in ElasticSearch: there is a single `p_name` set to `%{[merchandiser][product][name]}` and `product_name` is `name_1, name_2, name_3`

Instead, I would like to have 3 different records, each having their own unique `product_name`

What is correct xml filter?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 19, 2018, 1:24am UTC](https://discuss.elastic.co/t/logstash-parse-xml-attributes/145029/2 "2018-08-19T01:24:04Z")

</div>

If you have a field that is an array and you want to split it into one event per entry then use a [split](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html) filter.

---

<div class="post-metadata">

**Author:** ![Ju\_La](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@Ju\_La](https://discuss.elastic.co/u/Ju_La)\
**Post date:** [August 19, 2018, 12:27pm UTC](https://discuss.elastic.co/t/logstash-parse-xml-attributes/145029/3 "2018-08-19T12:27:16Z")

</div>

Do you have an example (based on the provided xml) that you can share?

---

<div class="post-metadata">

**Author:** ![Ju\_La](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@Ju\_La](https://discuss.elastic.co/u/Ju_La)\
**Post date:** [August 19, 2018, 9:45pm UTC](https://discuss.elastic.co/t/logstash-parse-xml-attributes/145029/4 "2018-08-19T21:45:45Z")

</div>

@magnusbaeck - Are you able to help out here? I see you have answered similar queries and was hoping to grab your attention.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2018, 9:45pm UTC](https://discuss.elastic.co/t/logstash-parse-xml-attributes/145029/5 "2018-09-16T21:45:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.