# XML: converting each tag attribute as the actual keys

**URL:** <https://discuss.elastic.co/t/xml-converting-each-tag-attribute-as-the-actual-keys/249546>\
**Category:** Logstash\
**Created:** [September 22, 2020, 3:23pm UTC](https://discuss.elastic.co/t/xml-converting-each-tag-attribute-as-the-actual-keys/249546 "2020-09-22T15:23:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![thdesy](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@thdesy](https://discuss.elastic.co/u/thdesy)\
**Post date:** [September 22, 2020, 3:23pm UTC](https://discuss.elastic.co/t/xml-converting-each-tag-attribute-as-the-actual-keys/249546/1 "2020-09-22T15:23:09Z")

</div>

Hi,

I have a somewhat XML log, where the attributes are the actual keys, e.g., [1]

each event is in a `<c>` tag and every message key/value is in a `<a>` tag. The actual key name is the `n` attribute and the value is in a 'file type' tag, so `<i>` for integers, `<s>` for strings and `<r>` for floats.

So, I attempted to select all /c/a/title() or text() via xpath and 'somehow' use the result to set the destination field with something like

```auto
input {
  file {
    path => "/var/log/loggy.xml"
    start_position => "beginning"
    exclude => "*.gz"
    type => "xml"
      codec => multiline {
	pattern => "<c>"
        negate => "true"
        what => "previous"
      }
  }
}

filter{
    xml{
        source => "message"
	store_xml => true
        target => "events"
        namespaces => {
          "xsl" => "http://www.w3.org/1999/XSL/Transform"
          "xhtml" => "http://www.w3.org/1999/xhtml"
        }
	xpath => ["/c/a/text()","text()"]
    }
}

```

However, I have not managed to select all the attribute elements and convert them to destiantion fields 😕

Maybe somebody has a tip for me, how to transform the events properly?

Later on, I probably would try to either mutate:gsub the file type tags to empty strings (don't know if mutate:convert could be used from a condition)

Cheers and thanks for ideas,  
Thomas

============================

[1]

```auto
<c>
    <a n="Proc"><i>0</i></a>
    <a n="Cluster"><i>64866</i></a>
    <a n="EventTime"><s>2020-09-17T16:40:17.878</s></a>
    <a n="MyType"><s>ExecuteEvent</s></a>
    <a n="ExecuteHost"><s>79655.0</s></a>
    <a n="Subproc"><i>0</i></a>
    <a n="EventTypeNumber"><i>1</i></a>
</c>
<c>
    <a n="SentBytes"><r>0.0</r></a>
    <a n="TotalRemoteUsage"><s>Usr 1 05:24:22, Sys 0 01:47:25</s></a>
    <a n="TotalLocalUsage"><s>Usr 0 00:00:00, Sys 0 00:00:00</s></a>
    <a n="EventTypeNumber"><i>5</i></a>
    <a n="TotalSentBytes"><r>0.0</r></a>
    <a n="Subproc"><i>0</i></a>
    <a n="MyType"><s>JobTerminatedEvent</s></a>
    <a n="RunRemoteUsage"><s>Usr 1 05:24:22, Sys 0 01:47:25</s></a>
    <a n="EventTime"><s>2020-09-17T16:40:37.992</s></a>
    <a n="Cluster"><i>62772</i></a>
    <a n="Proc"><i>0</i></a>
    <a n="ReceivedBytes"><r>0.0</r></a>
    <a n="TerminatedNormally"><b v="t"/></a>
    <a n="TotalReceivedBytes"><r>0.0</r></a>
    <a n="ReturnValue"><i>0</i></a>
    <a n="RunLocalUsage"><s>Usr 0 00:00:00, Sys 0 00:00:00</s></a>
</c>

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 22, 2020, 4:44pm UTC](https://discuss.elastic.co/t/xml-converting-each-tag-attribute-as-the-actual-keys/249546/2 "2020-09-22T16:44:58Z")

</div>

It is not entirely clear what you want to do, but I will take a guess 🙂 You will not be able to do it with xpath as far as I know, you would have to use ruby...

```
    xml {
        source => "message"
        target => "events"
        force_array => false
        store_xml => true
        namespaces => {
            "xsl" => "http://www.w3.org/1999/XSL/Transform"
            "xhtml" => "http://www.w3.org/1999/xhtml"
        }
    }
    ruby {
        code => '
            e = event.get("events")
            if e.is_a? Hash
                e["a"].each { |x|
                    key = x["n"]
                    if x["s"]
                        value = x["s"]
                    elsif x["i"]
                        value = x["i"].to_i
                    elsif x["r"]
                        value = x["r"].to_f
                    elsif x["b"]
                        value = (x["b"]["v"] == "t")
                    end
                    event.set(key, value)
                }
            end
        '
    }

```

will get you

```
           "Subproc" => 0,
"TerminatedNormally" => true,
   "EventTypeNumber" => 5,
            "MyType" => "JobTerminatedEvent",
          "@version" => "1",
       "ReturnValue" => 0,
   "TotalLocalUsage" => "Usr 0 00:00:00, Sys 0 00:00:00",
"TotalReceivedBytes" => 0.0

```

etc.

---

<div class="post-metadata">

**Author:** ![thdesy](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@thdesy](https://discuss.elastic.co/u/thdesy)\
**Post date:** [September 23, 2020, 12:34pm UTC](https://discuss.elastic.co/t/xml-converting-each-tag-attribute-as-the-actual-keys/249546/3 "2020-09-23T12:34:53Z")

</div>

ah, many thanks! That is it, what I have been looking for 😀

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 21, 2020, 12:35pm UTC](https://discuss.elastic.co/t/xml-converting-each-tag-attribute-as-the-actual-keys/249546/4 "2020-10-21T12:35:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.