Reading XML Attribute using XPATH in logstash


I am trying to parse below XML file in logstash.

 <OrderEvent actionCode = "5">

I was able to successfully parse OrderNumber and VendorNumber from the log. But I am not able to fetch actionCode from the XML.

Can anyone please help me.

Below is the snippet of the logstash for XML parsing.

if [fields][log_type] == "XMLs" {
		xml {
				source => "message"
				store_xml => false
				namespaces => {
					"xsl" => ""
					"xhtml" => ""
				xpath => ["/OrderEvent/title()", "ActionCode","/OrderEvent/OrderNumber/text()", "OrderNumber","/OrderEvent/VendorNumber/text()", "VendorNumber"]
		mutate { 
		add_field => ["Promotion_Source", "XMLs"]


try to use something like this for the xpath expression


got it form here



Thanks a lot for your response and help.

My issue has been resolved by the resolution provided by you.


we can generate xpath by giving xml data as input from online, with this link,

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.