# Mutiple xml file with same fields (How to handle?) any suggestion

**URL:** <https://discuss.elastic.co/t/mutiple-xml-file-with-same-fields-how-to-handle-any-suggestion/24061>\
**Category:** Logstash\
**Created:** [June 22, 2015, 8:03am UTC](https://discuss.elastic.co/t/mutiple-xml-file-with-same-fields-how-to-handle-any-suggestion/24061 "2015-06-22T08:03:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\
**Post date:** [June 22, 2015, 8:03am UTC](https://discuss.elastic.co/t/mutiple-xml-file-with-same-fields-how-to-handle-any-suggestion/24061/1 "2015-06-22T08:03:13Z")

</div>

xml {  
xpath =\> [

"/response/data/median/firstView/visualComplete/text()","FV\_visualComplete",  
"/response/data/median/firstView/lastVisualChange/text()","FV\_lastVisualChange",  
"/response/data/median/firstView/loadTime/text()","FV\_loadTime",  
"/response/data/median/firstView/fullyLoaded/text()","FV\_fullyLoaded",  
"/response/data/median/firstView/SpeedIndex/text()","FV\_SpeedIndex",  
"/response/data/median/firstView/TTFB/text()","FV\_TTFB",  
"/response/data/median/firstView/titleTime/text()","FV\_titleTime",  
] }

I have multiple XML file with above fields. When Logstash parses them, last file's value gets reflected in above fields.

Is there any way to handle?

---

<div class="post-metadata">

**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\
**Post date:** [June 22, 2015, 9:56am UTC](https://discuss.elastic.co/t/mutiple-xml-file-with-same-fields-how-to-handle-any-suggestion/24061/2 "2015-06-22T09:56:21Z")

</div>

Is possible to parse multiple XML file containing same fields to parse at once using logstash? any help will save my day.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 23, 2015, 10:47am UTC](https://discuss.elastic.co/t/mutiple-xml-file-with-same-fields-how-to-handle-any-suggestion/24061/3 "2015-06-23T10:47:45Z")

</div>

Each file _should_ be processed as a new message, but it sounds like LS things they are the same message and is just updating them.

Can you show us your config?

---

<div class="post-metadata">

**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\
**Post date:** [June 23, 2015, 10:55am UTC](https://discuss.elastic.co/t/mutiple-xml-file-with-same-fields-how-to-handle-any-suggestion/24061/4 "2015-06-23T10:55:01Z")

</div>

Yes i found a way. Now using below config file i am able to get them as a new message.  
input {  
file {  
path =\> "/opt/Log/WebPage10/RUN\*/\*\_XML\_WebpageSummary.xml"  
start\_position =\> "beginning"   
}  
}

filter {  
if [message] =~ "^\<?xml .\*" {  
drop {}  
}  
multiline {  
pattern =\> "^\</response\>"  
negate =\> true  
what =\> "next"  
}

xml {  
source =\> "message"  
target =\> "videoFrames"  
store\_xml =\> false  
xpath =\> ["/response/data/median/firstView/visualComplete/text()","visualComplete"]  
xpath =\> ["/response/data/run/firstView/videoFrames/frame[_]/time/text()","Time\_FV"]  
xpath =\> ["/response/data/run/repeatView/videoFrames//frame[_]/time/text()","Time\_RV"]  
}

Now I am struggling with "Time\_FV" & "Time\_RV" array fields. Each new message contains these two fields. I have to find the length of array(message which has this array field of maximum length) to split respective field. Any help?  
Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:36am UTC](https://discuss.elastic.co/t/mutiple-xml-file-with-same-fields-how-to-handle-any-suggestion/24061/5 "2017-07-06T05:36:44Z")

</div>

Closed on July 6, 2017, 5:36am UTC