# Unable to split Arrays into fields -parsing XML Attributes of an unknown number of child elements

**URL:** https://discuss.elastic.co/t/unable-to-split-arrays-into-fields-parsing-xml-attributes-of-an-unknown-number-of-child-elements/305144
**Category:** Logstash
**Created:** [May 19, 2022, 8:44am UTC](https://discuss.elastic.co/t/unable-to-split-arrays-into-fields-parsing-xml-attributes-of-an-unknown-number-of-child-elements/305144 "2022-05-19T08:44:31Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![rubberband](https://avatars.discourse-cdn.com/v4/letter/r/b5a626/32.png) [@rubberband](https://discuss.elastic.co/u/rubberband)
#### Post date: [May 19, 2022, 8:44am UTC](https://discuss.elastic.co/t/unable-to-split-arrays-into-fields-parsing-xml-attributes-of-an-unknown-number-of-child-elements/305144/1 "2022-05-19T08:44:31Z")

</div>

Hi,  
I'm trying to parse some XML content using Logstash. I'm trying to get the attributes as separate fields. Each `<CardData>` element will have some attributes that need to be parsed as fields and an unknown number of `<ListData>` child nodes each with their attributes, which also need to be parsed as fields.

This works easily using XPath for the first level - the **ID** attribute of `<CardData>`. but when there's more than one `<ListData>` element, I get an array that I want to split into separate fields - example below.

And in some cases, the child nodes could have one more layer of children as shown in the  
`<Results>` element.

I'm not sure how to proceed.

**Sample Input Data:**

```auto
<CardData ID="C1">
	<ListData SeriesNumber="1" Type="S" ID="A1"/>
	<ListData SeriesNumber="1" Type="S" ID="A2"/>	
	<ListData SeriesNumber="5" Type="H" ID="A4">
		<Results SeriesNumber="5.1" Name="AA" ID="R1"/>
		<Results SeriesNumber="5.2" Name="Mono" ID="R2"/>
	</ListData>
</CardData>

```

My **XPath** from the logstash.conf is as follows.

```auto
xml
	{
		source => "message"
		store_xml => false #default is true
		force_array => false	#default is true
		remove_namespaces => true
		#XPath Parser for LogMessages
		xpath =>
		[
            "/CardData/@ID", "carddata.id",
            "/CardData/ListData/@SeriesNumber", "carddata.listdata.seriesnumber",
            "/CardData/ListData/@Type", "carddata.listdata.type",
            "/CardData/ListData/@ID", "carddata.listdata.id",
        ]
}

```

**Expected Output**

```auto
carddata.id - C1
carddata.listdata1.seriesnumber - 1
carddata.listdata1.type - S
carddata.listdata1.id - A1
carddata.listdata2.seriesnumber - 1
carddata.listdata2.type - S
carddata.listdata2.id - A2
carddata.listdata3.seriesnumber - 5
carddata.listdata3.type - H
carddata.listdata3.id - A4

```

**Actual Output in Logstash:**

```auto
"carddata.id" => "C1",
"carddata.listdata.seriesnumber" => [
        [0] "1",
        [1] "1",
        [2] "5"
    ],
            "carddata.listdata.type" => [
        [0] "S",
        [1] "S",
        [2] "H"
    ],
            "carddata.listdata.id " => [
        [0] "A1",
        [1] "A2",
        [2] "A4"
    ]

```

**Actual Output in Kibana:**

```auto
carddata.id - C1
carddata.listdata.seriesnumber - 1 , 1 , 5
carddata.listdata.type - S , S , H
carddata.listdata.id - A1, A2, A4

```

I've tried using the split function within the mutate filter but that has yielded no results.  
Any help would be appreciated. Thanks.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 19, 2022, 3:23pm UTC](https://discuss.elastic.co/t/unable-to-split-arrays-into-fields-parsing-xml-attributes-of-an-unknown-number-of-child-elements/305144/3 "2022-05-19T15:23:10Z")

</div>

You could use something like [this](https://discuss.elastic.co/t/ruby-snippet-to-iterate-through-array-results-in-error-ruby-exception-occurred-undefined-method-for-logstash-0x69068bc1/222166/4).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 16, 2022, 3:23pm UTC](https://discuss.elastic.co/t/unable-to-split-arrays-into-fields-parsing-xml-attributes-of-an-unknown-number-of-child-elements/305144/4 "2022-06-16T15:23:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.