# Missing RSS Items

**URL:** <https://discuss.elastic.co/t/missing-rss-items/311199>\
**Category:** Logstash\
**Created:** [August 2, 2022, 10:25am UTC](https://discuss.elastic.co/t/missing-rss-items/311199 "2022-08-02T10:25:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pdziumla](https://avatars.discourse-cdn.com/v4/letter/p/a5b964/32.png) [@pdziumla](https://discuss.elastic.co/u/pdziumla)\
**Post date:** [August 2, 2022, 10:25am UTC](https://discuss.elastic.co/t/missing-rss-items/311199/1 "2022-08-02T10:25:41Z")

</div>

Hello Guys,

I'm completely new to RSS, XML and that stuff so I might overlook something quite simple here.  
So, here ist my problem:

I succesfully setup the RSS-Plugin and it's working fine. Except it seem to miss out on a field (or item?) that I need.  
Here ist the start of the RSS File, when I open it with a normal Texteditor:

```auto
<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0">
  <channel>
    <title>BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Security Advisories)</title>
    <link>https://wid.cert-bund.de/portal/wid/securityadvisory</link>
    <description>BSI Warn- und Informationsdienst (WID) RSS Feed zur Verteilung Schwachstellen-Informationen (Security Advisories)</description>
    <pubDate>Tue, 02 Aug 2022 09:00:12 GMT</pubDate>
    <item>
      <title>Atlassian Jira Software: Schwachstelle ermöglicht Codeausführung</title>
      <link>https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0881</link>
      <description>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Atlassian Jira Software ausnutzen, um beliebigen Programmcode auszuführen.</description>
      <category>mittel</category>
      <pubDate>Tue, 02 Aug 2022 08:46:47 GMT</pubDate>
    </item>
    <item>
      <title>vim: Mehrere Schwachstellen</title>
      <link>https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0880</link>
      <description>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in vim ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen und einen nicht spezifizierten Angriff durchzuführen.</description>
      <category>hoch</category>
      <pubDate>Tue, 02 Aug 2022 08:46:47 GMT</pubDate>
    </item>

```

All the fields are showing up in the kibana interface except _category_.

Why is that and how can I get logstash to also work with the _category_ field?

For more information:  
Logstash input:

```auto
input {
    rss {
        url => "https://wid.cert-bund.de/content/public/securityAdvisory/rss"
        id => "bsi-cert"
        # value in seconds
        interval => 600
    }
}

```

logstash output:

```auto
{
    elasticsearch {
        hosts => ["https://myhost"]
        document_id => "%{document.id}"
        action => "create"
        ssl => true
        manage_template => false
        ecs_compatibility => v1
        index => "myIndex-%{+YYYY-MM}"
        user => "user"
        password => "xxx"
    }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 2, 2022, 4:48pm UTC](https://discuss.elastic.co/t/missing-rss-items/311199/2 "2022-08-02T16:48:17Z")

</div>

The [code](https://github.com/logstash-plugins/logstash-input-rss/blob/18c01eed2bd7af3b23e22e9a2d178a47f16fbdfd/lib/logstash/inputs/rss.rb#L112) supports a subset of the elements that an item can contain. There is an [open issue](https://github.com/logstash-plugins/logstash-input-rss/issues/28) asking if category can be supported. The input really does have very minimal RSS support and could be greatly improved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2022, 4:48pm UTC](https://discuss.elastic.co/t/missing-rss-items/311199/3 "2022-08-30T16:48:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.