# Parsing XML file

**URL:** <https://discuss.elastic.co/t/parsing-xml-file/88854>\
**Category:** Logstash\
**Created:** [June 9, 2017, 2:34pm UTC](https://discuss.elastic.co/t/parsing-xml-file/88854 "2017-06-09T14:34:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [June 9, 2017, 2:34pm UTC](https://discuss.elastic.co/t/parsing-xml-file/88854/1 "2017-06-09T14:34:03Z")

</div>

Hi  
I am trying to parse [this XML file](https://pastebin.com/DE21nFnN) to fetch all the `<item name="Software Application"> </item>` tag and the property inside them under `<category name="Software"> </category>` . I also need to count no of `<item name="Software Application">` tag that are there. Is it possible that each item tag must be a doc thereby i can differentiate the properties under which item/category tag it falls. I have written the logstash configuration file, but the log says.

> [2017-06-09T14:04:04,247][DEBUG][logstash.inputs.file] \_globbed\_files: /home/xmldata/test.xml: glob is:   
> [2017-06-09T14:04:05,175][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
> [2017-06-09T14:04:10,175][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
> [2017-06-09T14:04:15,176][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
> [2017-06-09T14:04:19,253][DEBUG][logstash.inputs.file] \_globbed\_files: /home/xmldata/test.xml: glob is:   
> [2017-06-09T14:04:20,176][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
> [2017-06-09T14:04:25,175][DEBUG][logstash.pipeline] Pushing flush onto pipeline

The configuration file is -

```
input {
 file {
         path => "/home/xmldata/test.xml"
         start_position => beginning
         sincedb_path => "/home/xmldata/sincedb/test"
                codec => multiline
                 {
                   pattern => "<item name='Software Application'>|</item>"
                   negate => true
                   what => "previous"
                   auto_flush_interval => 1
                  }
      }
}
filter {
  if [message] == "<category/>" or [message] == "</category>" {
    drop {}
  }
  xml {
    source => "message"
    target => "message.parsed"
    xpath => ["/item/message/text()", itemmessage]
    force_array => false
  }
}

output {
        stdout { 
                codec => rubydebug 
               }
                elasticsearch {
                                  index => "logstash-xml-%{+dd.MM.YYYY}"
                                  hosts => ["localhost:9200"]
                                  document_id => "%{[id]}"
                                  document_type => "xmlfiles"
                }
} 

```

Is it the right way to parse an XML file in logstash ?  
Regards

---

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [June 9, 2017, 6:35pm UTC](https://discuss.elastic.co/t/parsing-xml-file/88854/2 "2017-06-09T18:35:43Z")

</div>

Hi  
I have entirely modified the logstash conf but now, i am getting -\>  
**Only String and Array types are splittable. field:[parsed][Software Application] is of type = NilClass**

The modified configuration file is-\>

> input {  
> file {  
> path =\> "/home/xmldata/test.xml"  
> start\_position =\> beginning  
> sincedb\_path =\> "/dev/null"  
> ignore\_older =\> 0  
> #codec =\> "plain"  
> }  
> }

> filter {  
> xml {  
> source =\> "message"  
> target =\> "parsed"  
> }  
> split {  
> # type =\> "string"  
> field =\> "[parsed][Software Application]"

> ```
> add_field => {
> Name => "%{[parsed][Software Application][name]}"
> }
> }
> 
> ```
> 
> }

Does the field [parsed][Software Application] type is not string ? I tried to convert it using type =\> "string" but that does not seems to work.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 11, 2017, 8:19pm UTC](https://discuss.elastic.co/t/parsing-xml-file/88854/3 "2017-06-11T20:19:56Z")

</div>

Please show an example event that Logstash has processed, e.g. by adding a `stdout { codec => rubydebug }` output (copy/paste from Kibana's JSON tab is also okay).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2017, 8:20pm UTC](https://discuss.elastic.co/t/parsing-xml-file/88854/4 "2017-07-09T20:20:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.