# Problem with xml filter

**URL:** https://discuss.elastic.co/t/problem-with-xml-filter/80725
**Category:** Logstash
**Created:** [March 30, 2017, 5:52pm UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725 "2017-03-30T17:52:42Z")
**Posts on this page:** 1
**Showing post:** 10

<div class="post-metadata">

### Author: ![GrahamHannington](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grahamhannington/32/4404_2.png) [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)
#### Post date: [March 31, 2017, 6:03am UTC](https://discuss.elastic.co/t/problem-with-xml-filter/80725/10 "2017-03-31T06:03:57Z")

</div>

Try this filter:

```
filter {
    xml {
        source => "message"
        target => "@metadata[xml_content]"
        force_array => false
    }
    # Copy XML content to first-level fields with all-lowercase names
    ruby {
        code => '
            event.get("@metadata[xml_content]").each do |key, value|
                event.set(key.downcase, value)
            end
        '
    }
    mutate {
         remove_field => ["message", "@metadata"]
         convert => {
           "durationseconds" => "integer"
         }
    }
    date {
        match => ["created", "ISO8601"]
    }
}

```

**Notes:**

- @magnusbaeck: I thought `@metadata` wasn’t supposed to get passed through to the output, but it does get included in output to stdin and Elasticsearch. Hence its presence in `remove_field`. Did I miss a memo? (I’m using Logstash 5.2.1.)
- That Ruby code is a workaround for the issue I describe in “[Set target of xml filter to root?](https://discuss.elastic.co/t/set-target-of-xml-filter-to-root/80770)”
- If you want to preserve the original case of the XML element names, remove `.downcase` from `key.downcase`

### Example Logstash output

In JSON format:

```
"@timestamp": "2015-12-22T08:20:03.000Z",
"completedtime": "2015-12-22T08:21:11",
"created": "2015-12-22T08:20:03",
"@version": "1",
"host": "58a3fe88f636",
"starttime": "2015-12-22T08:20:06",
"durationseconds": 68,
"taskid": "ServerTasks-5017",
"queuetime": "2015-12-22T08:20:03",
"taskstate": "Success"

```

### More unsolicited tips

If you can—if you are responsible for creating the original XML-format events—consider adding a zone designator to the time stamps. Otherwise, be sure that you understand the repercussions of specifying local times, and how those values might be interpreted.

---

_[View the full topic](https://discuss.elastic.co/t/problem-with-xml-filter/80725)._