# String field to date, parsing from xpath

**URL:** https://discuss.elastic.co/t/string-field-to-date-parsing-from-xpath/80872
**Category:** Logstash
**Created:** [March 31, 2017, 8:59pm UTC](https://discuss.elastic.co/t/string-field-to-date-parsing-from-xpath/80872 "2017-03-31T20:59:19Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![daian.martinho](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@daian.martinho](https://discuss.elastic.co/u/daian.martinho)
#### Post date: [March 31, 2017, 8:59pm UTC](https://discuss.elastic.co/t/string-field-to-date-parsing-from-xpath/80872/1 "2017-03-31T20:59:19Z")

</div>

Hi,

I'm trying to parse string field as date.

i got the value from an xml using xpath..

```
 xpath =>[                            
       "/ReportHost/HostProperties/tag[@name='HOST_START']/text()","report_host_start",
       "/ReportHost/HostProperties/tag[@name='HOST_END']/text()","report_host_end"         
 ]

```

Resulting in string field like "Fri Feb 17 00:22:07 2017".

I'm trying to parse with date plugin.

```
date {
           match => ["report_host_start", "EEE MMM dd HH:mm:ss yyyy"]
           target => "report_host_start"
           locale => "en_US"
}

```

without success...

i'm deleting index data before every test..

can anyone help me? tnks

---

<div class="post-metadata">

### Author: ![GrahamHannington](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grahamhannington/32/4404_2.png) [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)
#### Post date: [April 1, 2017, 2:11pm UTC](https://discuss.elastic.co/t/string-field-to-date-parsing-from-xpath/80872/2 "2017-04-01T14:11:52Z")

</div>

Yes, I can help.

### Solution

Insert the following `mutate` filter between your `xml` filter and your `date` filter:

```
mutate {
  replace => { "report_host_start" => "%{report_host_start[0]}" }
}

```

Example JSON output:

```
"report_host_start":"2017-02-17T00:22:07.000Z"

```

### Explanation

The `xpath` setting of the `xml` filter returns an array:

```
["Fri Feb 17 00:22:07 2017"]

```

which the `date` filter does not match.

The `mutate` filter replaces the array with the value of its first element:

```
"Fri Feb 17 00:22:07 2017"

```

which the `date` filter _does_ match.

### Further reading

See the GitHub issue “[Handling xpath results](https://github.com/logstash-plugins/logstash-filter-xml/issues/36)”.

### Unsolicited advice

To match your situation as closely as possible, I used the XPath expression you cited to create the following sample XML input file:

```
<ReportHost>
  <HostProperties>
    <tag name="HOST_START">Fri Feb 17 00:22:07 2017</tag>
    <tag name="HOST_END"><!-- Some end date --></tag>
  </HostProperties>
</ReportHost>

```

Just a thought (not having a go): it occurs to me that other users who know far more about Logstash than me, but perhaps might not be as fluent in XPath, might have offered you an answer if you had provided such a sample.

Off-topic: have you considered specifying a [`timezone`](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-timezone) setting in your `date` filter?

---

<div class="post-metadata">

### Author: ![daian.martinho](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@daian.martinho](https://discuss.elastic.co/u/daian.martinho)
#### Post date: [April 3, 2017, 2:19am UTC](https://discuss.elastic.co/t/string-field-to-date-parsing-from-xpath/80872/3 "2017-04-03T02:19:44Z")

</div>

Thank you very much! Great answer.  
It worked and i understood the problem.

---

<div class="post-metadata">

### Author: ![GrahamHannington](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grahamhannington/32/4404_2.png) [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)
#### Post date: [April 3, 2017, 2:49am UTC](https://discuss.elastic.co/t/string-field-to-date-parsing-from-xpath/80872/4 "2017-04-03T02:49:26Z")

</div>

You’re welcome. I’ve recently received some extremely useful help via these forums, so I was looking for an opportunity to contribute. Glad I could help.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 1, 2017, 2:49am UTC](https://discuss.elastic.co/t/string-field-to-date-parsing-from-xpath/80872/5 "2017-05-01T02:49:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.