# Parsing XML document contained in a field

**URL:** https://discuss.elastic.co/t/parsing-xml-document-contained-in-a-field/275037
**Category:** Logstash
**Created:** [June 5, 2021, 4:11pm UTC](https://discuss.elastic.co/t/parsing-xml-document-contained-in-a-field/275037 "2021-06-05T16:11:55Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![fmaginga](https://avatars.discourse-cdn.com/v4/letter/f/bbce88/32.png) [@fmaginga](https://discuss.elastic.co/u/fmaginga)
#### Post date: [June 5, 2021, 4:11pm UTC](https://discuss.elastic.co/t/parsing-xml-document-contained-in-a-field/275037/1 "2021-06-05T16:11:55Z")

</div>

We have written a logstash configuration file with kv filter plugin to extract key-value pairs successfully. Some of the values is the keys contains XML documents as example below. What is the better way to parse the XML document contained in a field to extract the fields contained in the XML document?

```auto
<any>
	<xcap:MMTel-extension xmlns:xcap=\"http://uri.etsi.org/ngn/params/xml/simservs/xcap\">
		<xcap:basic-part>
			<xcap:call-source-code>710</xcap:call-source-code>
			<xcap:call-out-authority>
				<xcap:local>true</xcap:local>
				<xcap:local-toll>true</xcap:local-toll>
				<xcap:national-toll>true</xcap:national-toll>
				<xcap:international-toll>true</xcap:international-toll>
				<xcap:intra-local-toll>true</xcap:intra-local-toll>
				<xcap:intra-national-toll>true</xcap:intra-national-toll>
				<xcap:customized-call-out-authority1>true</xcap:customized-call-out-authority1>
				<xcap:customized-call-out-authority2>true</xcap:customized-call-out-authority2>
				<xcap:customized-call-out-authority3>true</xcap:customized-call-out-authority3>
			</xcap:call-out-authority>
			<xcap:user-category>ordinary</xcap:user-category>
			<xcap:user-password> ****** </xcap:user-password>
			<xcap:charge-mode>online-charging-and-offline-charging</xcap:charge-mode>
			<xcap:charge-source-code>27</xcap:charge-source-code>
			<xcap:limit-group>65535</xcap:limit-group>
			<xcap:limitation-of-parallel-calls>1</xcap:limitation-of-parallel-calls>
			<xcap:implicit-ua-profile-subscribe>true</xcap:implicit-ua-profile-subscribe>
			<xcap:carrier-pre-selection>
				<xcap:high-priority-cps-index>255</xcap:high-priority-cps-index>
				<xcap:local-cps-index>255</xcap:local-cps-index>
				<xcap:national-cps-index>255</xcap:national-cps-index>
				<xcap:international-cps-index>255</xcap:international-cps-index>
				<xcap:mobile-cps-index>255</xcap:mobile-cps-index>
			</xcap:carrier-pre-selection>
		</xcap:basic-part>
	</xcap:MMTel-extension>
	<Compress>0</Compress>
	<CheckSum>0</CheckSum>
</any>

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 5, 2021, 4:26pm UTC](https://discuss.elastic.co/t/parsing-xml-document-contained-in-a-field/275037/2 "2021-06-05T16:26:13Z")

</div>

Use an [xml](https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html) filter.

---

<div class="post-metadata">

### Author: ![fmaginga](https://avatars.discourse-cdn.com/v4/letter/f/bbce88/32.png) [@fmaginga](https://discuss.elastic.co/u/fmaginga)
#### Post date: [June 5, 2021, 4:39pm UTC](https://discuss.elastic.co/t/parsing-xml-document-contained-in-a-field/275037/3 "2021-06-05T16:39:01Z")

</div>

Can you please provide an example with reference to the XML document attached?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 5, 2021, 4:51pm UTC](https://discuss.elastic.co/t/parsing-xml-document-contained-in-a-field/275037/4 "2021-06-05T16:51:44Z")

</div>

If you have a field containing XML you can parse the whole XML document using

xml { source =\> "someField" store\_xml =\> true target =\> "theXML" }

If you want to pick a subset of the fields out of the document you can use the xpath option instead. There are many examples in this forum.

---

<div class="post-metadata">

### Author: ![fmaginga](https://avatars.discourse-cdn.com/v4/letter/f/bbce88/32.png) [@fmaginga](https://discuss.elastic.co/u/fmaginga)
#### Post date: [June 14, 2021, 4:40pm UTC](https://discuss.elastic.co/t/parsing-xml-document-contained-in-a-field/275037/5 "2021-06-14T16:40:10Z")

</div>

I have used the XML filter plugin in this manner and it is working perfectly;

```auto
xml {
source => "SourceField"
target => "DestinationField"
force_array => false
}

```

Thanks @Badger for some comments.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 12, 2021, 4:41pm UTC](https://discuss.elastic.co/t/parsing-xml-document-contained-in-a-field/275037/6 "2021-07-12T16:41:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.