# Problem parsing large XML with logstash?

**URL:** https://discuss.elastic.co/t/problem-parsing-large-xml-with-logstash/90122
**Category:** Logstash
**Created:** [June 20, 2017, 3:51pm UTC](https://discuss.elastic.co/t/problem-parsing-large-xml-with-logstash/90122 "2017-06-20T15:51:30Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)
#### Post date: [June 20, 2017, 3:51pm UTC](https://discuss.elastic.co/t/problem-parsing-large-xml-with-logstash/90122/1 "2017-06-20T15:51:30Z")

</div>

Logstash 2.4.1

I want to parse a XML file :

```
   <?xml version="1.0" encoding="ISO-8859-1"?>
    <catalog>
      <cd country="USA">
        <title>Empire Burlesque</title>
        <artist>Bob Dylan</artist>
        <price>10.90</price>
      </cd>
      <cd country="UK">
        <title>Hide your heart</title>
        <artist>Bonnie Tyler</artist>
        <price>10.0</price>
      </cd>
      <cd country="USA">
        <title>Greatest Hits</title>
        <artist>Dolly Parton</artist>
        <price>9.90</price>
      </cd>
</catalog>

```

I want output in this format :

```
  "country" => "USA" ,
     "title" => [
    [0] "Empire Burlesque"
],
    "artist" => [
    [0] "Bob Dylan"
],
     "price" => [
    [0] "10.90"
],
      "country" => "UK" ,
     "title" => [
    [0] "Hide your heart"
],
    "artist" => [
    [0] "Bonnie Tyler"
],
     "price" => [
    [0] "10.0"
],
   so on .....

```

But what i got is like this :

```
 "country" => [
    [0] "USA",
    [1] "UK",
    [2] "USA"
],
     "title" => [
    [0] "Empire Burlesque",
    [1] "Hide your heart",
    [2] "Greatest Hits"
],
    "artist" => [
    [0] "Bob Dylan",
    [1] "Bonnie Tyler",
    [2] "Dolly Parton"
],
     "price" => [
    [0] "10.90",
    [1] "10.0",
    [2] "9.90"
]

```

My logstash configuration is like this :

```
input {
      file {
            path => "F:\logstash-2.4.0\logstash-2.4.0\bin\samplexml.xml"
            start_position => "beginning"
            sincedb_path => "NUL"
	    codec => multiline {
               pattern => "^<\?cd.*\>"
               negate => true
               what => "previous"
        }
  }

}
filter {
    xml {
   source => "message"
   xpath => 
   [ 
     "/catalog/cd/@country", "country",
     "/catalog/cd/title/text()", "title",
     "/catalog/cd/artist/text()", "artist",
     "/catalog/cd/price/text()", "price"
   ]
   store_xml => false
   target => "doc"
        }
    }
output {
 stdout { codec => rubydebug }
  }

```

How can i achieve the my desired output from the above xml file?

Thanks

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 21, 2017, 7:15am UTC](https://discuss.elastic.co/t/problem-parsing-large-xml-with-logstash/90122/2 "2017-06-21T07:15:57Z")

</div>

> In the output it is merging all the events in one field but what i want is something like this:

In your example there are multiple fields with the same name. That's not possible to have so I don't know what you want things to look like.

---

<div class="post-metadata">

### Author: ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)
#### Post date: [June 21, 2017, 7:48am UTC](https://discuss.elastic.co/t/problem-parsing-large-xml-with-logstash/90122/3 "2017-06-21T07:48:27Z")

</div>

Thanks @magnusbaeck

I updated my question with a small example hope this will get you clear on my requirement.[quote="magnusbaeck, post:2, topic:90122"]  
In your example there are multiple fields with the same name  
[/quote]

SO, You if multiple fields has same name i can't able to divide it based on `"country"`.

Thanks

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 21, 2017, 8:30am UTC](https://discuss.elastic.co/t/problem-parsing-large-xml-with-logstash/90122/4 "2017-06-21T08:30:36Z")

</div>

> I updated my question with a small example hope this will get you clear on my requirement.

No, that example has the same problem. I'm guessing you want this (expressing it as JSON):

```plaintext
"some_field": [
  {
    "country": "USA",
    "title": "Empire Burlesque",
    ...
  },
  {
    "country": "UK",
    "title": "Hide your heart",
    ...
  },
  ...
]

```

In other words an array of objects, each object representing an album.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 19, 2017, 8:30am UTC](https://discuss.elastic.co/t/problem-parsing-large-xml-with-logstash/90122/5 "2017-07-19T08:30:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.