# Parse XML file question

**URL:** <https://discuss.elastic.co/t/parse-xml-file-question/125527>\
**Category:** Logstash\
**Created:** [March 26, 2018, 2:07am UTC](https://discuss.elastic.co/t/parse-xml-file-question/125527 "2018-03-26T02:07:54Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)\
**Post date:** [March 26, 2018, 2:07am UTC](https://discuss.elastic.co/t/parse-xml-file-question/125527/1 "2018-03-26T02:07:54Z")

</div>

Hi experts,

I have parsed a XML file by using Xpath, but some field can't be detect, would you please help me check it? Thank you.

# The input file:

```
<?xml version="1.0" encoding="UTF-8"?>
<OMeS version="2.3">
  <PMSetup startTime="2018-03-09T08:15:00.000+01:00" interval="5">
    <PMMOResult>
      <MO dimension="network_element">
        <DN>NTAS-tas01/HOSTNAME-cbam-4c63de7aeae2460289cd4197dc7-admintd-node-0/DBTYPE-cmdb</DN>
      </MO>
      <PMTarget measurementType="DBMEAS">
        <M704B1C1>32</M704B1C1>
        <M704B1C2>188</M704B1C2>
        <M704B1C3>0</M704B1C3>
        <M704B1C4>0</M704B1C4>
      </PMTarget>
    </PMMOResult>
    <PMMOResult>
      <MO dimension="network_element">
        <DN>NTAS-tas01/HOSTNAME-cbam-4c63de7aeae2460289cd4197dc7-admintd-node-1/DBTYPE-cmdb</DN>
      </MO>
      <PMTarget measurementType="DBMEAS">
        <M704B1C1>30</M704B1C1>
        <M704B1C2>116</M704B1C2>
        <M704B1C3>0</M704B1C3>
        <M704B1C4>1</M704B1C4>
      </PMTarget>
    </PMMOResult>

```

=============================================================

# The parsed pattern

```
xml {
                        source => "message"
                        target => "parsed"

                        xpath => [
                                "/OMeS/PMSetup/@startTime", "audit_time",
                                "/OMeS/PMSetup/PMMOResult/MO/@dimension", "ELKNE",
                                "/OMeS/PMSetup/PMMOResult/MO/DN/text()", "ELKDN",
                                "/OMeS/PMSetup/PMMOResult/PMTarget/@measurementType", "ELKPMtype",
                                "/OMeS/PMSetup/PMMOResult/PMTatget/M704B1C1/text()", "ELKPVo"
                       ]

```

=======================================================================

Now the major question is:  
"/OMeS/PMSetup/PMMOResult/PMTatget/M704B1C1/text()", "ELKPVo" can't get this `<M704B1C1>32</M704B1C1>` value!

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [March 26, 2018, 2:21am UTC](https://discuss.elastic.co/t/parse-xml-file-question/125527/2 "2018-03-26T02:21:46Z")

</div>

What's the output look like? Is there an error message in either Logstash or Elasticsearch? Have you looked at the debug level logs?

---

<div class="post-metadata">

**Author:** ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)\
**Post date:** [March 26, 2018, 2:33am UTC](https://discuss.elastic.co/t/parse-xml-file-question/125527/3 "2018-03-26T02:33:41Z")

</div>

Thanks a lot to answer my question.  
How can I check debug level logs?  
I only have the output from kibana, it shows as below:

 ![elk1](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f63ac4e11a22f33ac1f6abfab1f9fd25ea5d7738.png)

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [March 26, 2018, 2:41am UTC](https://discuss.elastic.co/t/parse-xml-file-question/125527/4 "2018-03-26T02:41:45Z")

</div>

To turn on debug logging in Logstash, put `log.level: debug` in logstash.yml. For Elasticsearch, `logger.level: debug` in elasticsearch.yml. These can be very chatty logs so be sure to comment the settings out after you finish troubleshooting.

So two things to start: open an event that makes it into Kibana and click the arrow to expand the event. Then click on JSON and post a capture of it on here. Second, post your full pipeline on here so we can better understand the whole process the data is going through.

---

<div class="post-metadata">

**Author:** ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)\
**Post date:** [March 26, 2018, 3:22am UTC](https://discuss.elastic.co/t/parse-xml-file-question/125527/5 "2018-03-26T03:22:15Z")

</div>

Hi wwalker,

The Json data is too large to upload. from the Json, there is no area populated from OMeS/PMSetup/PMMOResult/PMTatget/M704B1C1/text()

The whole pattern:  
input {

```
        file {
                path => ["/home/admin/log/NTASlog/*xml"]
                start_position => "beginning"
                type => "pmxmllog"
                sincedb_path => "/home/admin/log/NTASlog/.sincedb_file"
                codec => multiline {
                        pattern => "<?xml version"
                        #auto_flush_interval => 5
                        #max_lines => 60000
                        what => "previous"
                        negate=> true
                }

        }

}

filter {

        if [type] == "pmxmllog" {

                xml {
                        source => "message"
                        target => "parsed"

                        xpath => [
                                "/OMeS/PMSetup/@startTime", "audit_time",
                                "/OMeS/PMSetup/PMMOResult/MO/@dimension", "ELKNE",
                                "/OMeS/PMSetup/PMMOResult/MO/DN/text()", "ELKDN",
                                "/OMeS/PMSetup/PMMOResult/PMTarget/@measurementType", "ELKPMtype",
                                "/OMeS/PMSetup/PMMOResult/PMTatget/M704B1C1/text()", "ELKPVo"
                                #"/OMeS/PMSetup/PMMOResult/PMTatget[@measurementType]/M704B1C1/text()", "ELKPVoo",
                                #"/OMeS/PMSetup/PMMOResult/PMTatget//M704B1C1/text()", "ELKPVooo"
                                #"/OMeS/PMSetup/PMMOResult/PMTatget[1]/text()", "PV2"
                                #"/OMeS/PMSetup/PMMOResult/PMTatget/M704B1C3[0]", "PV3",
                                #"/OMeS/PMSetup/PMMOResult/PMTatget/M704B1C4[1]", "PV4"
                        ]

                }
        }

        #mutate {
        # split => ["NE", ","]
        #}

        #mutate {
        # split => ["DN", ","]
        #}

        date {
                match => ["audit_time", "YYYY-MM-DD HH:MM:SS.SSS"]
# target => "audit_time"
# locale => "en_US"
                timezone => "UTC"

        }

}

output {
        elasticsearch {
                        hosts => ["localhost:9200"]
        }
}

```

And some output log from ela

 ![elk2](https://us1.discourse-cdn.com/elastic/original/3X/4/f/4f01205a2fc90a1a26aae8fc14a7935a6f9b456c.png)  
 ![elk3](https://us1.discourse-cdn.com/elastic/original/3X/e/8/e8591d37f66d331b39c975bedf34570e45dab897.png)

---

<div class="post-metadata">

**Author:** ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)\
**Post date:** [March 26, 2018, 5:55am UTC](https://discuss.elastic.co/t/parse-xml-file-question/125527/6 "2018-03-26T05:55:42Z")

</div>

Hi wwalker,

I consider I have found the issue....  
`"/OMeS/PMSetup/PMMOResult/PMTatget/M704B1C1/text()"`  
The "target" I have type to "tatget"...

Thanks to your request of "post your full pipeline on here", I have found the issue.  
Thanks a lot for your supports.

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [March 27, 2018, 2:33am UTC](https://discuss.elastic.co/t/parse-xml-file-question/125527/7 "2018-03-27T02:33:50Z")

</div>

> [@terrymu](#):
>
> Hi wwalker,
> 
> I consider I have found the issue....  
> `"/OMeS/PMSetup/PMMOResult/PMTatget/M704B1C1/text()"`  
> The "target" I have type to "tatget"...
> 
> Thanks to your request of "post your full pipeline on here", I have found the issue.  
> Thanks a lot for your supports.

doh! Two sets of eyes took a long time to spot that one.

---

<div class="post-metadata">

**Author:** ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)\
**Post date:** [March 27, 2018, 3:22am UTC](https://discuss.elastic.co/t/parse-xml-file-question/125527/8 "2018-03-27T03:22:45Z")

</div>

Hi wwalker,

I have met another issue, can you provide some helps for me?

> [@How to transfer the array to csv format](https://discuss.elastic.co/t/how-to-transfer-the-array-to-csv-format/125685):
>
> Hi experts, I have parsed the XML file and get some useful NODEs' information, they are saved as a array format. I want to draw a trend chart by using Kibana, but I can't draw it because all of data are saved as array format. Would you please help me solve this block issue? The input XML files shows as below: \<?xml version="1.0" encoding="UTF-8"?\> \<OMeS version="2.3"\> \<PMSetup startTime="2018-03-09T08:15:00.000+01:00" interval="5"\> \<PMMOResult\> \<MO dimension="network\_element"\> …

Thank you.

---

<div class="post-metadata">

**Author:** ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)\
**Post date:** [March 27, 2018, 3:23am UTC](https://discuss.elastic.co/t/parse-xml-file-question/125527/9 "2018-03-27T03:23:48Z")

</div>

Hi wwalker,

## I have met another issue, can you provide some helps for me?

- 
- 

> [@How to transfer the array to csv format](https://discuss.elastic.co/t/how-to-transfer-the-array-to-csv-format/125685):
>
> Hi experts, I have parsed the XML file and get some useful NODEs' information, they are saved as a array format. I want to draw a trend chart by using Kibana, but I can't draw it because all of data are saved as array format. Would you please help me solve this block issue? The input XML files shows as below: \<?xml version="1.0" encoding="UTF-8"?\> \<OMeS version="2.3"\> \<PMSetup startTime="2018-03-09T08:15:00.000+01:00" interval="5"\> \<PMMOResult\> \<MO dimension="network\_element"\> …

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2018, 3:23am UTC](https://discuss.elastic.co/t/parse-xml-file-question/125527/10 "2018-04-24T03:23:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.