Traverse through XML document

Hi
I have the below XML structure with a list of cartItem (it can be N and not definite in number). I want help for the below queries

1 - I want to traverse through each of the cartItem and check the conditions based on cartItem.action & if the condition matches then access cartItem.externalProductId of that particular cartItem node.

2 - How to write the Sample XML filter in order to do the above and also in general to parse this entire XML and access each of the elements like cartItems & Cart.cartNumber ..etc.

<SOAP-ENV:Envelope>
<SOAP-ENV:Header/>
<SOAP-ENV:Body>
	<ns5:Submit_REQ>
		<ns5:Body>
			<ns5:Cart>
				<ns5:cartNumber></ns5:cartNumber>
				<ns5:createdDate></ns5:createdDate>
				<ns5:price></ns5:price>
				<ns5:cartItemList>
					<ns5:cartItem>
						<ns5:id>1</ns5:id>
						<ns5:externalProductId></ns5:externalProductId>
						<ns5:CheckoutPrice></ns5:CheckoutPrice>
						<ns5:action></ns5:action>
					</ns5:cartItem>
					<ns5:cartItem>
						<ns5:id>2</ns5:id>
						<ns5:externalProductId></ns5:externalProductId>
						<ns5:CheckoutPrice></ns5:CheckoutPrice>
						<ns5:action></ns5:action>
					</ns5:cartItem>
				<ns5:cartItem>
						<ns5:id>N</ns5:id>
						<ns5:externalProductId></ns5:externalProductId>
						<ns5:CheckoutPrice></ns5:CheckoutPrice>
						<ns5:action></ns5:action>
					</ns5:cartItem>						
				</ns5:cartItemList>
			</ns5:Cart>
		</ns5:Body>
	</ns5:Submit_REQ>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

You can parse it with an XML filter. I cannot get the namespaces option to work and I am drawing a blank on why, so I just strip the namespaces. To process a variable length array you will need a ruby filter.

    mutate { gsub => [ "message", "</?SOAP-ENV:[^>]+>", "" ] }
    mutate { gsub => [ "message", "ns5:", "" ] }
    xml { source => "message" target => "theXML" force_array => false remove_field => [ "message" ] }
    ruby {
        code => '
            c = event.get("[theXML][Body][Cart][cartItemList][cartItem]")
            if c
                c.each_index { |x|
                    # Do something with c[x]
                }
            end
        '
    }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.