# XML Filter :How to create array of objects using xml filter (xpath)

**URL:** <https://discuss.elastic.co/t/xml-filter-how-to-create-array-of-objects-using-xml-filter-xpath/144143>\
**Category:** Logstash\
**Created:** [August 13, 2018, 9:54am UTC](https://discuss.elastic.co/t/xml-filter-how-to-create-array-of-objects-using-xml-filter-xpath/144143 "2018-08-13T09:54:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Muhammed\_Aboobacker](https://avatars.discourse-cdn.com/v4/letter/m/cdc98d/32.png) [@Muhammed\_Aboobacker](https://discuss.elastic.co/u/Muhammed_Aboobacker)\
**Post date:** [August 13, 2018, 9:54am UTC](https://discuss.elastic.co/t/xml-filter-how-to-create-array-of-objects-using-xml-filter-xpath/144143/1 "2018-08-13T09:54:05Z")

</div>

I am new to logstash. I am trying push XML (generated as the output of http polling) in logstash. I want to have the XML elements attributes convert to json objects.I am using xpath for parsing xml data.But i am getting separate array of xpath fields insteda of array of objects.

My http response will be like this:

 17 `AGFAM` Falmouth Harbor P CARB AG -4.0000 1 18 `GPIDS` Iles Des Saintes P CARB GP 0.0000 1 19 `MQQMR` Le Marin P CARB MQ -4.0000 1 

My logstach confi xml filter like this:

filter {

xml {  
store\_xml =\> "false"  
source =\> "message"  
target =\> "abc"  
remove\_field =\> ["message","http\_poller\_metadata","@version","@timestamp"]  
xpath =\> [  
"/ResListLocation/LocationList/Location/LocationId/text()", "id",  
"/ResListLocation/LocationList/Location/Name/text()", "name",  
"/ResListLocation/LocationList/Location/Code/text()", "code"

```
]
force_array => false

```

}  
}

I am gertting output like this:

```
 {
                "_index": "logst41",
                "_type": "port",
                "_id": "AWUlK6ZzTgnFfJZNCIK6",
                "_score": 1,
                "_source": {
                    "code": [
                        "AGFAM",
                        "GRKAP",
                        "SIKOP",
                        "MEKOT"
                    ],
                    "name": [
                        "Salem, Massachusetts",
                        "Bridgetown",
                        "Santa Marta",
                        "Tampa"
                    ],
                    "id": [
                        "17",
                        "18",
                        "19",
                        "20"
                    ]
                }
}

```

But I am expecting output like this:

{  
"\_index": "logst41",  
"\_type": "port",  
"\_id": "AWUlK6ZzTgnFfJZNCIK6",  
"\_score": 1,  
"\_source": {  
abc:[  
{"code":"AGFAM", "name":"Salem, Massachusetts","id": "17"},  
{"code":"GRKAP", "name":"Bridgetown","id": "18"},  
{"code":"SIKOP", "name":"Santa Marta","id": "19"}  
]  
}

```
}
```

---

<div class="post-metadata">

**Author:** ![Muhammed\_Aboobacker](https://avatars.discourse-cdn.com/v4/letter/m/cdc98d/32.png) [@Muhammed\_Aboobacker](https://discuss.elastic.co/u/Muhammed_Aboobacker)\
**Post date:** [August 13, 2018, 10:08am UTC](https://discuss.elastic.co/t/xml-filter-how-to-create-array-of-objects-using-xml-filter-xpath/144143/2 "2018-08-13T10:08:17Z")

</div>

```
<ResListLocation>
    <Result>
        <Status>A</Status>
    </Result>
    <LocationList>
        <Location>
            <LocationId>17</LocationId>
            <Code>AGFAM</Code>
            <Name>Falmouth Harbor</Name>
            <Type>P</Type>
            <Region>CARB</Region>
            <Country>AG</Country>
            <TimeZone>-4.0000</TimeZone>
            <Enabled>1</Enabled>
        </Location>
        <Location>
            <LocationId>18</LocationId>
            <Code>GPIDS</Code>
            <Name>Iles Des Saintes</Name>
            <Type>P</Type>
            <Region>CARB</Region>
            <Country>GP</Country>
            <TimeZone>0.0000</TimeZone>
            <Enabled>1</Enabled>
        </Location>
        <Location>
            <LocationId>19</LocationId>
            <Code>MQQMR</Code>
            <Name>Le Marin</Name>
            <Type>P</Type>
            <Region>CARB</Region>
            <Country>MQ</Country>
            <TimeZone>-4.0000</TimeZone>
            <Enabled>1</Enabled>
        </Location>
</LocationList>
</ResListLocation>
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 13, 2018, 5:54pm UTC](https://discuss.elastic.co/t/xml-filter-how-to-create-array-of-objects-using-xml-filter-xpath/144143/3 "2018-08-13T17:54:57Z")

</div>

Yeah... that's how the filter works. You can use a ruby filter to join the elements of each array into an array of objects. I believe examples of this have been posted in the past.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 13, 2018, 6:20pm UTC](https://discuss.elastic.co/t/xml-filter-how-to-create-array-of-objects-using-xml-filter-xpath/144143/4 "2018-08-13T18:20:39Z")

</div>

Something like this:

```
    ruby { code => "
        c = event.get('code')
        i = event.get('id')
        n = event.get('name')
        a = []
        c.each_index { |k|
            h = { 'code' => c[k], 'id' => i[k], 'name' => n[k] }
            a << h
        }
        event.set('arrayOfHashes', a)
    "

```

Error handling is left as an exercise for the reader.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 10, 2018, 6:20pm UTC](https://discuss.elastic.co/t/xml-filter-how-to-create-array-of-objects-using-xml-filter-xpath/144143/5 "2018-09-10T18:20:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.