# Xml file parsing

**URL:** <https://discuss.elastic.co/t/xml-file-parsing/165550>\
**Category:** Logstash\
**Created:** [January 24, 2019, 8:18am UTC](https://discuss.elastic.co/t/xml-file-parsing/165550 "2019-01-24T08:18:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![fadihaddad](https://avatars.discourse-cdn.com/v4/letter/f/4bbf92/32.png) [@fadihaddad](https://discuss.elastic.co/u/fadihaddad)\
**Post date:** [January 24, 2019, 8:18am UTC](https://discuss.elastic.co/t/xml-file-parsing/165550/1 "2019-01-24T08:18:04Z")

</div>

here is a sample of my xml file

 ![xmlsample](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f488e2e73abdbf55425ee1dc34be38c96103bd6b.png)

this is the first time I want to use an xml filter and I am lost. how can I use an xsd structure for it and how can I map value types

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 24, 2019, 2:06pm UTC](https://discuss.elastic.co/t/xml-file-parsing/165550/2 "2019-01-24T14:06:08Z")

</div>

Please post text, not screen shots.

---

<div class="post-metadata">

**Author:** ![fadihaddad](https://avatars.discourse-cdn.com/v4/letter/f/4bbf92/32.png) [@fadihaddad](https://discuss.elastic.co/u/fadihaddad)\
**Post date:** [January 24, 2019, 6:30pm UTC](https://discuss.elastic.co/t/xml-file-parsing/165550/3 "2019-01-24T18:30:01Z")

</div>

okay sorry he is the text  
\<measCollecFile xmlns="[http://www.3gpp.org/ftp/specs/archive/32\_series/32.435#measCollec](http://www.3gpp.org/ftp/specs/archive/32_series/32.435#measCollec)"\>

\<fileHeader fileFormatVersion="32.435 V9.0" vendorName="Ericsson"\>

\<fileSender/\>

\<measCollec beginTime="2019-01-17T03:00:00+02:00"/\>

\</fileHeader\>

\<measData\>

\<managedElement localDn="AdmMME"/\>

\<measInfo measInfoId="SGSN-MME\_BSSGP"\>

\<job jobId="25014551\_USERDEF.SGSN\_KPIs\_counters.Profile\_25014551.Continuous\_Y.MEASJOB"/\>

\<granPeriod duration="PT900S" endTime="2019-01-17T03:15:00+02:00"/\>

\<repPeriod duration="PT900S"/\>

\<measType p="1"\>bssgpAttResumeProc\</measType\>

\<measType p="2"\>bssgpAttSuspendProc\</measType\>

\<measType p="3"\>bssgpDownlinkPacketsBuff\</measType\>

\<measType p="4"\>bssgpDownlinkPacketsBuffBucketFull\</measType\>

\<measType p="5"\>bssgpDownlinkPacketsBuffLlcSuspend\</measType\>

\<measType p="6"\>bssgpDownlinkPacketsBuffMobileSuspend\</measType\>

\<measType p="7"\>bssgpDownlinkPacketsBuffSnapshot\</measType\>

\<measType p="8"\>bssgpDownlinkPacketsDiscardLlcSuspended\</measType\>

\<measType p="9"\>bssgpDownlinkPacketsDiscardedBucketFull\</measType\>

\<measType p="10"\>bssgpDownlinkPacketsDiscardedBvcBlocked\</measType\>

\<measType p="11"\>bssgpDownlinkPacketsDiscardedMobileSuspend\</measType\>

\<measValue measObjLdn="ManagedElement=AdmMME,SgsnFunction=1"\>

\<r p="1"\>955\</r\>

\<r p="2"\>23697\</r\>

\<r p="3"\>58797\</r\>

\<r p="4"\>41276\</r\>

\<r p="5"\>12427\</r\>

\<r p="6"\>88\</r\>

\<r p="7"\>1619\</r\>

\<r p="8"\>2258\</r\>

\<r p="9"\>6570\</r\>

\<r p="10"\>0\</r\>

\<r p="11"\>36\</r\>

\</measValue\>

\</measInfo\>

\<measInfo measInfoId="SGSN-MME\_BSSGP\_Nse"\>

\<job jobId="25014551\_USERDEF.SGSN\_KPIs\_counters.Profile\_25014551.Continuous\_Y.MEASJOB"/\>

\<granPeriod duration="PT900S" endTime="2019-01-17T03:15:00+02:00"/\>

\<repPeriod duration="PT900S"/\>

\<measType p="1"\>bssgpDownlinkOctets\</measType\>

\<measType p="2"\>bssgpDownlinkPackets\</measType\>

\<measType p="3"\>bssgpDownlinkPacketsSignalling\</measType\>

\<measType p="4"\>bssgpStatusBvcUnknown\</measType\>

\<measType p="5"\>bssgpUplinkOctets\</measType\>

\<measType p="6"\>bssgpUplinkPackets\</measType\>

\<measType p="7"\>bssgpUplinkPacketsSignalling\</measType\>

\<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,GbIp=1,GbIpNse=111"\>

\<r p="1"\>708755287\</r\>

\<r p="2"\>1313662\</r\>

\<r p="3"\>176092\</r\>

\<r p="4"\>0\</r\>

\<r p="5"\>258079376\</r\>

\<r p="6"\>1640366\</r\>

\<r p="7"\>178163\</r\>

\</measValue\>

\<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,GbIp=1,GbIpNse=77"\>

\<r p="1"\>60\</r\>

\<r p="2"\>15\</r\>

\<r p="3"\>15\</r\>

\<r p="4"\>0\</r\>

\<r p="5"\>345\</r\>

\<r p="6"\>15\</r\>

\<r p="7"\>15\</r\>

\</measValue\>

\</measInfo\>

\<measInfo measInfoId="SGSN-MME\_Ethernet"\>

\<job jobId="25014551\_USERDEF.SGSN\_KPIs\_counters.Profile\_25014551.Continuous\_Y.MEASJOB"/\>

\<granPeriod duration="PT900S" endTime="2019-01-17T03:15:00+02:00"/\>

\<repPeriod duration="PT900S"/\>

\<measType p="1"\>ethInErrors\</measType\>

\<measType p="2"\>ethOutErrors\</measType\>

\<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=0"\>

\<r p="1"\>0\</r\>

\<r p="2"\>0\</r\>

\</measValue\>

\<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=1"\>

\<r p="1"\>0\</r\>

\<r p="2"\>0\</r\>

\</measValue\>

\<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=2"\>

\<r p="1"\>0\</r\>

\<r p="2"\>0\</r\>

\</measValue\>

\<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=3"\>

\<r p="1"\>0\</r\>

\<r p="2"\>0\</r\>

\</measValue\>

\<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=4"\>

\<r p="1"\>0\</r\>

\<r p="2"\>0\</r\>

\</measValue\>

\<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=5"\>

\<r p="1"\>0\</r\>

\<r p="2"\>0\</r\>

\</measValue\>

\<measValue measObjLdn="ManagedElement=AdmMME,SgsnMme=1,PIU=2.1,EthPort=6"\>

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 24, 2019, 9:36pm UTC](https://discuss.elastic.co/t/xml-file-parsing/165550/4 "2019-01-24T21:36:26Z")

</div>

Your XML is not valid. It is missing \</measData\> and \</measCollecData.

Assuming your input includes those, you need to consume the entire XML as a single event. You can probably do that using a multiline codec on a file input, or in filebeat if you are using that.

Once you have valid in an event there are two approaches to parsing it. One is to use

```
    xml {
        source => "message"
        target => "theXML"
        store_xml => true
    }

```

that gets you the entire message structure with the field theXML. Note that almost everything is an array. For example,

```
    "theXML" => {
         "xmlns" => "http://www.3gpp.org/ftp/specs/archive/32_series/32.435#measCollec",
      "measData" => [
        [0] {
                  "measInfo" => [
                [0] {
                    "measInfoId" => "SGSN-MME_BSSGP",
                    "granPeriod" => [
                        [0] {
                            "duration" => "PT900S",
                             "endTime" => "2019-01-17T03:15:00+02:00"
                        }
                    ],
                      "measType" => [
                        [0] {
                                  "p" => "1",
                            "content" => "bssgpAttResumeProc"
                        },
[...]
    ],
    "fileHeader" => [
        [0] {
                   "vendorName" => "Ericsson",
            "fileFormatVersion" => "32.435 V9.0",
                   "fileSender" => [
                [0] nil
            ],
[...]
},

```

The alternative is xpath. And for the life of me I cannot get this to work with your data. I tried many variants of this and I cannot extract either elements or attributes. Maybe someone else can suggest something.

```
    xml {
        source => "message"
        store_xml => false
        xpath => { '/measCollecFile/fileHeader/measCollec/@beginTime' => "begin" }
    }
```

---

<div class="post-metadata">

**Author:** ![fadihaddad](https://avatars.discourse-cdn.com/v4/letter/f/4bbf92/32.png) [@fadihaddad](https://discuss.elastic.co/u/fadihaddad)\
**Post date:** [January 24, 2019, 11:48pm UTC](https://discuss.elastic.co/t/xml-file-parsing/165550/5 "2019-01-24T23:48:22Z")

</div>

Thank you for your reply, well it has an xds schema if there is a way to map it to it since it is a bit complicated xml file

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2019, 11:48pm UTC](https://discuss.elastic.co/t/xml-file-parsing/165550/6 "2019-02-21T23:48:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.