# Set target of xml filter to root?

**URL:** https://discuss.elastic.co/t/set-target-of-xml-filter-to-root/80770
**Category:** Logstash
**Created:** [March 31, 2017, 3:43am UTC](https://discuss.elastic.co/t/set-target-of-xml-filter-to-root/80770 "2017-03-31T03:43:40Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![GrahamHannington](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grahamhannington/32/4404_2.png) [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)
#### Post date: [March 31, 2017, 3:43am UTC](https://discuss.elastic.co/t/set-target-of-xml-filter-to-root/80770/1 "2017-03-31T03:43:40Z")

</div>

I want the `store_xml` setting of the `xml` filter to store child elements of the input XML event as top-level fields.

Is this possible? Or should I create an issue in GitHub for this?

For example, given this input XML event:

```
<event>
  <property1>v1</property1>
  <property2>v2</property2>
</event>

```

I want this output:

```
"@timestamp":"...",
"property1":"v1",
"property2":"v2"

```

not, say:

```
"@timestamp":"...",
"xml_content": {
  "property1":"v1",
  "property2":"v2"
}

```

And to do that, I’d prefer not to mess around individually creating new top-level fields from the `store_xml` target, and then removing that target (or using a target under `@metadata`).

For example, is there some existing “Logstash field reference syntax” that I can use to represent “root” as the value of the `target` setting?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 31, 2017, 11:42am UTC](https://discuss.elastic.co/t/set-target-of-xml-filter-to-root/80770/2 "2017-03-31T11:42:14Z")

</div>

My gut reaction would've been to use an empty `target`, but that's not allowed (it might even have been me who wrote the piece of code that rejects empty targets). Since there's no other way of denoting the root I don't think it's possible to store the results from an xml filter anywhere except under an existing field.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 28, 2017, 11:42am UTC](https://discuss.elastic.co/t/set-target-of-xml-filter-to-root/80770/3 "2017-04-28T11:42:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.