# Split xml xpath
**URL:** https://discuss.elastic.co/t/split-xml-xpath/84336
**Category:** Logstash
**Created:** [May 3, 2017, 12:55am UTC](https://discuss.elastic.co/t/split-xml-xpath/84336 "2017-05-03T00:55:52Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@daian.martinho](https://discuss.elastic.co/u/daian.martinho)
#### Post date: [May 3, 2017, 12:55am UTC](https://discuss.elastic.co/t/split-xml-xpath/84336/1 "2017-05-03T00:55:52Z")
Hi,
when parsing 4 xml files, sometimes the first and sometimes the last one has parse error. (cant split nillclass) . Am I doing something wrong?
```
input {
beats {
port => "5044"
}
}
filter {
## interpret the message as XML
if [type] == "nessus-report" {
xml {
source => "message"
store_xml => false
xpath =>[
"/NessusClientData_v2/Report/@name","report_name",
"/NessusClientData_v2/Report/ReportHost","report_host"
]
}
split {
field => "report_host"
}
xml {
source => "report_host"
store_xml => false
xpath =>[
"/ReportHost/ReportItem","report_item",
"/ReportHost/@name","report_host_name",
"/ReportHost/HostProperties/tag[@name='HOST_START']/text()","report_host_start",
"/ReportHost/HostProperties/tag[@name='HOST_END']/text()","report_host_end"
]
}
split {
field => "report_item"
}
xml {
source => "report_item"
store_xml => false
xpath => [
"/ReportItem/@port","report_item_port",
"/ReportItem/@svc_name","report_item_svc_name",
"/ReportItem/@protocol","report_item_protocol"
]
}
grok {
match => ["source","%{GREEDYDATA}/%{GREEDYDATA:history_id}\.xml"]
}
mutate {
add_field => { "index_report_name" => "%{report_name}" }
remove_field => ["message","report_host","report_item"]
replace => { "report_host_start" => "%{report_host_start[0]}" }
replace => { "report_host_end" => "%{report_host_end[0]}" }
convert => { "report_item_severity" => "integer" }
}
mutate {
gsub => [
#remove all whitespaces
"index_report_name", " ", "-"
]
}
mutate{
lowercase => ["index_report_name"]
}
date {
match => [ "report_host_start", "EEE MMM d HH:mm:ss yyyy",
"EEE MMM dd HH:mm:ss yyyy" ]
target => "report_host_start"
locale => "en_US"
timezone => "UTC"
}
date {
match => [ "report_host_end", "EEE MMM d HH:mm:ss yyyy",
"EEE MMM dd HH:mm:ss yyyy" ]
target => "report_host_end"
locale => "en_US"
timezone => "UTC"
}
}
}
output {
if [type]=="nessus-report" {
elasticsearch {
hosts => ["10.99.40.16:9200"]
manage_template => false
index => "%{type}-%{index_report_name}-%{+YYYY.MM.dd}"
}
}
}
```
.example of parsing error
```
{
"_index" : "nessus-report-%{report_name}-2017.05.02",
"_type" : "nessus-report",
"_id" : "AVvLcflLmDMb90aiL7fj",
"_score" : 0.2876821,
"_source" : {
"report_host_end" : "%{report_host_end[0]}",
"offset" : 259,
"report_host_start" : "%{report_host_start[0]}",
"input_type" : "log",
"source" : "/opt/ctb-odin-nessus-scan/downloads/211.xml",
"type" : "nessus-report",
"history_id" : "211",
"tags" : [
"beats_input_codec_plain_applied",
"_split_type_failure",
"_dateparsefailure"
],
"@timestamp" : "2017-05-02T23:14:50.080Z",
"@version" : "1",
"beat" : {
"hostname" : "hyoga",
"name" : "hyoga",
"version" : "5.3.0"
},
"host" : "hyoga",
"index_report_name" : "%{report_name}"
}
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 3, 2017, 5:40am UTC](https://discuss.elastic.co/t/split-xml-xpath/84336/2 "2017-05-03T05:40:29Z")
It looks like you're trying to split a field that doesn't exist. Since you're deleting the `message` field where the XML data is stored it's hard to backtrack what's going on, but since there's no `_xmlparsefailure` tag it seems the XML at least is well-formed.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 31, 2017, 5:47am UTC](https://discuss.elastic.co/t/split-xml-xpath/84336/3 "2017-05-31T05:47:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.