# Problem with xml filter
**URL:** https://discuss.elastic.co/t/problem-with-xml-filter/80725
**Category:** Logstash
**Created:** [March 30, 2017, 5:52pm UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725 "2017-03-30T17:52:42Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@flalar](https://discuss.elastic.co/u/flalar)
#### Post date: [March 30, 2017, 5:52pm UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/1 "2017-03-30T17:52:42Z")
We're having issues setting a date pulled from a xml document as @timestamp in the date filter.
input xml looks like this
` ServerTasks-5017 Success 2015-12-22T08:20:03 2015-12-22T08:20:03 2015-12-22T08:20:06 2015-12-22T08:21:11 68 `
Filer looks like this
`filter { xml { source => "message" target => "xml_content" xpath => ["//Created/text()", "created"] } date { match => ["created","yyyy-MM-dd'T'HH:mm:ss"] #match => ["xml_content.Created", "yyyy-MM-dd'T'HH:mm:ss"] } }`
As you can see I've both tried to match the content pulled from the xml directly and with the xpath.
Both end up with \_dateparsefailure and the @timestamp is set the the logstash time.
Any tips for a novice logstash user on how to resolve this?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 30, 2017, 7:21pm UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/2 "2017-03-30T19:21:00Z")
I'm not XPath-fluent, but shouldn't the expression be //Task/Created/text()? What does the resulting event look like? Use a `stdout { codec => rubydebug }` output. Also, what's in the logs? When the date filter fails it tells you why in the log.
---
### Author:  [@flalar](https://discuss.elastic.co/u/flalar)
#### Post date: [March 30, 2017, 8:17pm UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/3 "2017-03-30T20:17:46Z")
timestamp and "created" looks like this
"@timestamp" =\> 2017-03-30T18:29:09.354Z,
"created" =\> [
[0] "2015-12-22T08:20:03"
],
"@version" =\> "1",
Might be looking in the wrong log but cant find anything relating to \_dateparsefailure in the log. Even tried to set level to debug.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 30, 2017, 8:21pm UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/4 "2017-03-30T20:21:48Z")
The problem is that `created` is an array. Disable the xml filter's `force_array` option.
---
### Author:  [@flalar](https://discuss.elastic.co/u/flalar)
#### Post date: [March 30, 2017, 9:45pm UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/5 "2017-03-30T21:45:53Z")
Thanks for your help! Much appreciated!
even setting 'force\_array' to false gives xpath extracted element 'created' as array. Rest of the content that is not extracted with xpath is now not in array format.
Any tips? Can i reference the first element of the array 'created' somehow?
---
### Author:  [@jordansissel](https://discuss.elastic.co/u/jordansissel)
#### Post date: [March 30, 2017, 9:57pm UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/6 "2017-03-30T21:57:40Z")
I can reproduce your behavior:
```auto
% bin/logstash -e 'filter { xml { source => "message" xpath => { "//Created/text()" => "foo" } store_xml => false } } '
{
"@timestamp" => 2017-03-29T06:49:47.122Z,
"foo" => [
[0] "2015-12-22T08:20:03"
],
...
```
I agree this behavior is not what I'd expect š
There's an open issue [on the logstash-filter-xml project](https://github.com/logstash-plugins/logstash-filter-xml/issues/36) that mentions this issue. Your feedback on this issue is welcome š
---
### Author:  [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)
#### Post date: [March 31, 2017, 1:47am UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/7 "2017-03-31T01:47:10Z")
> [@flalar](#):
>
> Can i reference the first element of the array 'created' somehow?
Yes.
Until the issue mentioned by @jordansissel is resolved, insert the following `mutate` filter after the `xml` filter:
```
mutate {
replace => { "created" => "%{created[0]}" }
}
```
This replaces the array with the value of the first (and, in this case, only) element.
That is, instead of:
```
"created":["2015-12-22T08:20:03"]
```
the output contains:
```
"created":"2015-12-22T08:20:03"
```
---
### Author:  [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)
#### Post date: [March 31, 2017, 2:52am UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/8 "2017-03-31T02:52:15Z")
Regarding the following `match` setting (commented-out in your example):
```
match => ["xml_content.Created", "yyyy-MM-dd'T'HH:mm:ss"]
```
From the Elastic docs topic ā[Accessing Event Data and Fields in the Configuration](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)ā:
> The syntax to access a field is [fieldname]. If you are referring to a top-level field, you can omit the and simply use fieldname. To refer to a nested field, you specify the full path to that field: [top-level field][nested field].
Replace `xml_content.Created` with `xml_content[Created]`
Works with your sample XML data in Logstash 5.2.1, withāas recommended by @magnusbaeckā`force_array => false`.
---
### Author:  [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)
#### Post date: [March 31, 2017, 3:02am UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/9 "2017-03-31T03:02:51Z")
> [@magnusbaeck](#):
>
> shouldn't the expression be //Task/Created/text()
The expression that you cite and the original expression will both work. However, `/Task/Created/text()` (note the single leading slash) is better.
From the [XPath W3C recommendation](https://www.w3.org/TR/xpath/):
> // is short for /descendant-or-self::node()/.
A more specific path, such as `/Task/Created`, is typically more efficient (and less likely to select nodes that you didnāt intend to š).
---
### Author:  [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)
#### Post date: [March 31, 2017, 6:03am UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/10 "2017-03-31T06:03:57Z")
Try this filter:
```
filter {
xml {
source => "message"
target => "@metadata[xml_content]"
force_array => false
}
# Copy XML content to first-level fields with all-lowercase names
ruby {
code => '
event.get("@metadata[xml_content]").each do |key, value|
event.set(key.downcase, value)
end
'
}
mutate {
remove_field => ["message", "@metadata"]
convert => {
"durationseconds" => "integer"
}
}
date {
match => ["created", "ISO8601"]
}
}
```
**Notes:**
- @magnusbaeck: I thought `@metadata` wasnāt supposed to get passed through to the output, but it does get included in output to stdin and Elasticsearch. Hence its presence in `remove_field`. Did I miss a memo? (Iām using Logstash 5.2.1.)
- That Ruby code is a workaround for the issue I describe in ā[Set target of xml filter to root?](https://discuss.elastic.co/t/set-target-of-xml-filter-to-root/80770)ā
- If you want to preserve the original case of the XML element names, remove `.downcase` from `key.downcase`
### Example Logstash output
In JSON format:
```
"@timestamp": "2015-12-22T08:20:03.000Z",
"completedtime": "2015-12-22T08:21:11",
"created": "2015-12-22T08:20:03",
"@version": "1",
"host": "58a3fe88f636",
"starttime": "2015-12-22T08:20:06",
"durationseconds": 68,
"taskid": "ServerTasks-5017",
"queuetime": "2015-12-22T08:20:03",
"taskstate": "Success"
```
### More unsolicited tips
If you canāif you are responsible for creating the original XML-format eventsāconsider adding a zone designator to the time stamps. Otherwise, be sure that you understand the repercussions of specifying local times, and how those values might be interpreted.
---
### Author:  [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)
#### Post date: [March 31, 2017, 8:27am UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/11 "2017-03-31T08:27:42Z")
> [@jordansissel](#):
>
> Your feedback on this issue is welcome š
I have added [my two cents](https://github.com/logstash-plugins/logstash-filter-xml/issues/36#issuecomment-290648647) to that issue.
---
### Author:  [@flalar](https://discuss.elastic.co/u/flalar)
#### Post date: [April 4, 2017, 7:37am UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/12 "2017-04-04T07:37:35Z")
This works perfectly! Thank you all for all tips!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 2, 2017, 7:37am UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/13 "2017-05-02T07:37:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.