# Parsing jenkins xml using logstash

**URL:** https://discuss.elastic.co/t/parsing-jenkins-xml-using-logstash/133863
**Category:** Logstash
**Created:** [May 30, 2018, 11:29am UTC](https://discuss.elastic.co/t/parsing-jenkins-xml-using-logstash/133863 "2018-05-30T11:29:34Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![qylw](https://avatars.discourse-cdn.com/v4/letter/q/f04885/32.png) [@qylw](https://discuss.elastic.co/u/qylw)
#### Post date: [May 30, 2018, 11:29am UTC](https://discuss.elastic.co/t/parsing-jenkins-xml-using-logstash/133863/1 "2018-05-30T11:29:35Z")

</div>

Hey there,

I'm trying to parse jenkins build.xml files via filebeat/logstash.  
The documents gets transferred from filebeat fine, I see the documents in kibana that contains the full content, but easy xpath:

```
filter
{
xml
{
    source => "message"
    store_xml => true
    target => "log"
    xpath => [
        "/log/flow-build/queueId/text()", "queueId"
    ]
}
}

```

is failing.  
The error I'm getting from logstash is:

`[2018-05-30T11:19:08,124][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-2018.05.30", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x71178c99>], :response=>{"index"=>{"_index"=>"filebeat-2018.05.30", "_type"=>"doc", "_id"=>"TVXFsGMBFEFgAXJp37H0", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Limit of mapping depth [20] in index [filebeat-2018.05.30] has been exceeded due to object field [log.actions.org.jenkinsci.plugins.pipeline.modeldefinition.actions.ExecutionModelAction.stagesList.org.jenkinsci.plugins.pipeline.modeldefinition.ast.ModelASTStages.stages.org.jenkinsci.plugins.pipeline.modeldefinition.ast.ModelASTStage.branches.org.jenkinsci.plugins.pipeline.modeldefinition.ast.ModelASTBranch.steps.org.jenkinsci.plugins.pipeline.modeldefinition.ast.ModelASTTreeStep.children.org.jenkinsci.plugins.pipeline.modeldefinition.ast.ModelASTScriptBlock.args.arguments.entry.org]"}}}}`

Do I read it correctly that the XML too complex to be parsed? Is there anything I can do to be parsable by logstash? Or should I switch to regexp/grok?

Regards,  
Roman

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 30, 2018, 11:58am UTC](https://discuss.elastic.co/t/parsing-jenkins-xml-using-logstash/133863/2 "2018-05-30T11:58:10Z")

</div>

It's not the parsing that fails, it's Elasticsearch that doesn't like the resulting nesting depth. Do you really need to store the full JSON representation of the XML?

---

<div class="post-metadata">

### Author: ![qylw](https://avatars.discourse-cdn.com/v4/letter/q/f04885/32.png) [@qylw](https://discuss.elastic.co/u/qylw)
#### Post date: [May 30, 2018, 12:09pm UTC](https://discuss.elastic.co/t/parsing-jenkins-xml-using-logstash/133863/3 "2018-05-30T12:09:51Z")

</div>

No I don't. I wish to store set of interesting fields only. How do I disable to store the full JSON representation?

---

<div class="post-metadata">

### Author: ![qylw](https://avatars.discourse-cdn.com/v4/letter/q/f04885/32.png) [@qylw](https://discuss.elastic.co/u/qylw)
#### Post date: [May 30, 2018, 12:29pm UTC](https://discuss.elastic.co/t/parsing-jenkins-xml-using-logstash/133863/4 "2018-05-30T12:29:57Z")

</div>

> [@qylw](#):
>
> store\_xml =\> false

isn't it?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 30, 2018, 12:42pm UTC](https://discuss.elastic.co/t/parsing-jenkins-xml-using-logstash/133863/5 "2018-05-30T12:42:48Z")

</div>

Yes, disable `store_xml` (then you can also remove the `target` setting).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 27, 2018, 12:42pm UTC](https://discuss.elastic.co/t/parsing-jenkins-xml-using-logstash/133863/6 "2018-06-27T12:42:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
