# Parsing nested XML into logstash

**URL:** https://discuss.elastic.co/t/parsing-nested-xml-into-logstash/125131
**Category:** Logstash
**Created:** [March 22, 2018, 8:28am UTC](https://discuss.elastic.co/t/parsing-nested-xml-into-logstash/125131 "2018-03-22T08:28:59Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![porkiz](https://avatars.discourse-cdn.com/v4/letter/p/8c91f0/32.png) [@porkiz](https://discuss.elastic.co/u/porkiz)
#### Post date: [March 22, 2018, 8:29am UTC](https://discuss.elastic.co/t/parsing-nested-xml-into-logstash/125131/1 "2018-03-22T08:29:00Z")

</div>

```
<eg>
	<suite>
		<some_data_1 attr1>test 1
		<some_data_2 attr2>test 2
	</suite>
	<suite>
		<some_data_3 attr3>test 3
		<some_data_4 attr4>test 4
	</suite>
</eg>
<appendix>
	<more info>
		<some_data_1 attr1>Info1
		<some_data_2 attr2>Info2
	</more info>
	<more info>
		<some_data_1 attr3>info3
		<some_data_2 attr4>info4
	</more info>
</appendix>

```

* * *

How can I parse this XML file in logstash such that I can tag the more info under some data. An example is shown below:

```
<eg>
	<suite>
		<some_data_1 attr1>test 1
                        <some_data_1 attr1>Info1

```

With this I can map the field into elastic as the same index but the problem is how do I do it first in logstash. I explored XML filter xpath and split filter but both does not work? Any help would be much appreciated.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 22, 2018, 10:26am UTC](https://discuss.elastic.co/t/parsing-nested-xml-into-logstash/125131/2 "2018-03-22T10:26:41Z")

</div>

The xml filter would be the right avenue here. What problems did you have?

---

<div class="post-metadata">

### Author: ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [March 22, 2018, 1:18pm UTC](https://discuss.elastic.co/t/parsing-nested-xml-into-logstash/125131/3 "2018-03-22T13:18:45Z")

</div>

> [@porkiz](#):
>
> ```
> <eg>
> <suite>
> <some_data_1 attr1>test 1
> <some_data_2 attr2>test 2
> </suite>
> <suite>
> <some_data_3 attr3>test 3
> <some_data_4 attr4>test 4
> </suite>
> </eg>
> <appendix>
> <more info>
> <some_data_1 attr1>Info1
> <some_data_2 attr2>Info2
> </more info>
> <more info>
> <some_data_1 attr3>info3
> <some_data_2 attr4>info4
> </more info>
> </appendix>
> 
> ```
> 
> * * *
> 
> How can I parse this XML file in logstash such that I can tag the more info under some data. An example is shown below:
> 
> ```
> <eg>
> <suite>
> <some_data_1 attr1>test 1
> <some_data_1 attr1>Info1
> 
> ```
> 
> With this I can map the field into elastic as the same index but the problem is how do I do it first in logstash. I explored XML filter xpath and split filter but both does not work? Any help would be much appreciated.

Multiline codec on your input along with the XML filter's xpath functions will get you what you want. The Elastic Stack sees related data as an Event. Delineation between different events is done per line. In your example, Logstash thinks you just fed it 20 events. To fix this, use the [Multiline codec](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html) to cram everything onto a single line. In your [XML Filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html), use [xpath](https://www.w3schools.com/xml/xpath_intro.asp) to define what to label the field as and what the data in the field is. For example:

```
filter {
  xml {
    xpath => [
      "/eg/suite/some_data_1_attr1/text()", "Attribute 1"
    ]
  }
}

```

This will give you a field named `Attribute 1` with a value of `test 1`.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 19, 2018, 1:18pm UTC](https://discuss.elastic.co/t/parsing-nested-xml-into-logstash/125131/4 "2018-04-19T13:18:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.