# Reading XML Attribute using XPATH in logstash

**URL:** <https://discuss.elastic.co/t/reading-xml-attribute-using-xpath-in-logstash/148833>\
**Category:** Logstash\
**Created:** [September 17, 2018, 12:29pm UTC](https://discuss.elastic.co/t/reading-xml-attribute-using-xpath-in-logstash/148833 "2018-09-17T12:29:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vivek\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivek_sharma/32/46948_2.png) [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)\
**Post date:** [September 17, 2018, 12:29pm UTC](https://discuss.elastic.co/t/reading-xml-attribute-using-xpath-in-logstash/148833/1 "2018-09-17T12:29:26Z")

</div>

Hi

I am trying to parse below XML file in logstash.

```
 <OrderEvent actionCode = "5">
 <OrderNumber>ORD12345</OrderNumber>
 <VendorNumber>V11111</VendorNumber>
 </OrderEvent>

```

I was able to successfully parse **OrderNumber** and **VendorNumber** from the log. But I am not able to fetch **actionCode** from the XML.

Can anyone please help me.

Below is the snippet of the logstash for XML parsing.

```
if [fields][log_type] == "XMLs" {
		xml {
				source => "message"
				store_xml => false
				namespaces => {
					"xsl" => "http://www.w3.org/1999/XSL/Transform"
					"xhtml" => "http://www.w3.org/1999/xhtml"
				}
				xpath => ["/OrderEvent/title()", "ActionCode","/OrderEvent/OrderNumber/text()", "OrderNumber","/OrderEvent/VendorNumber/text()", "VendorNumber"]
				
			}
					
		mutate { 
		add_field => ["Promotion_Source", "XMLs"]
		
		}
	}

```

Thanks

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [September 17, 2018, 1:48pm UTC](https://discuss.elastic.co/t/reading-xml-attribute-using-xpath-in-logstash/148833/2 "2018-09-17T13:48:33Z")

</div>

try to use something like this for the xpath expression

```auto
/OrderEvent/@actionCode

```

got it form here  
[https://www.w3schools.com/xml/xpath\_syntax.asp](https://www.w3schools.com/xml/xpath_syntax.asp)

---

<div class="post-metadata">

**Author:** ![Vivek\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivek_sharma/32/46948_2.png) [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)\
**Post date:** [September 18, 2018, 9:21am UTC](https://discuss.elastic.co/t/reading-xml-attribute-using-xpath-in-logstash/148833/3 "2018-09-18T09:21:03Z")

</div>

Hi

Thanks a lot for your response and help.

My issue has been resolved by the resolution provided by you.

Thanks

---

<div class="post-metadata">

**Author:** ![balumurari1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balumurari1/32/39203_2.png) [@balumurari1](https://discuss.elastic.co/u/balumurari1)\
**Post date:** [October 9, 2018, 12:00pm UTC](https://discuss.elastic.co/t/reading-xml-attribute-using-xpath-in-logstash/148833/4 "2018-10-09T12:00:27Z")

</div>

we can generate xpath by giving xml data as input from online, with this link,

[http://xmltoolbox.appspot.com/xpath\_generator.html](http://xmltoolbox.appspot.com/xpath_generator.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2018, 12:00pm UTC](https://discuss.elastic.co/t/reading-xml-attribute-using-xpath-in-logstash/148833/5 "2018-11-06T12:00:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.