# XML filter plugin is not working!

**URL:** <https://discuss.elastic.co/t/xml-filter-plugin-is-not-working/76723>\
**Category:** Logstash\
**Created:** [February 28, 2017, 5:29am UTC](https://discuss.elastic.co/t/xml-filter-plugin-is-not-working/76723 "2017-02-28T05:29:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ritesh\_Sharma](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@Ritesh\_Sharma](https://discuss.elastic.co/u/Ritesh_Sharma)\
**Post date:** [February 28, 2017, 5:29am UTC](https://discuss.elastic.co/t/xml-filter-plugin-is-not-working/76723/1 "2017-02-28T05:29:08Z")

</div>

Hi People ,

I am pulling some stream of XML files from Kafka topic and trying to fetch one of the element of XML file through Logstash using XML filter plugin but unable to do so ; mentioning details below ;

XML block of stream :

\<?xml v="1.0" enc="UF-8"?\> 

\<\ns0:LogRequest xmlns:ns0="[http://SOME/URL/SOME.xsd](http://SOME/URL/SOME.xsd)"\>  
\<\ns1:Header xmlns:ns1="[http://SOME/URL/SOME1.xsd](http://SOME/URL/SOME1.xsd)"\>  
\<\ns1:ApplicationID\>ABC\</ns1:ApplicationID\>  
\<\ns1:ComponentName\>XYZ\</ns1:ComponentName\>  
\<\ns1:Hostname\>MYHOST\</ns1:Hostname\>  
\<\ns1:Timestamp\>2017-02-27T23:07:44.318+05:30\</ns1:Timestamp\>  
\<\ns1:TransactionDomain\>Some Domain \</ns1:TransactionDomain\>  
\<\ns1:TransactionType\>Some Type\</ns1:TransactionType\>  
\<\ns1:Message\>Some Message \</ns1:Message\>  
\<\ns1:AltKey\>\n  
\<\ns1:AltKeyName\>LOG\</ns1:Alt\KeyName\>  
\<\ns1:AltKeyValue\>Some Key \</ns1:AltKeyValue\>\n  
\</ns1:AltKey\>\n  
\</ns1:Header\>\n  
\<\TimeDuration\>1488217064317\</TimeDuration\>\n  
\<\Status\>Some Status \</Status\>\n  
\<\Audit\>true\n\</ns0:LogRequest\> "

I want to fetch the value of "Timestamp" and save it as new field but unable to do so ,

Filter block of Logstash.conf :

filter {  
xml {  
store\_xml =\> "false"  
remove\_namespaces =\> "true"  
source =\> "message"  
xpath =\> ["/LogRequest/Timestamp/text()", "mytime"]  
}

mutate {  
add\_field =\> ["Timestamp", "%{mytime}"]  
}  
}

In output, new field "Timestamp" is getting added but value of same remain as %{mytime} i.e. static string .

KIndly help !!

P.S. : I am new to Xpath .  
I have appended the xml with "" at every line, as It was difficult to post normal xml here.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 28, 2017, 6:57am UTC](https://discuss.elastic.co/t/xml-filter-plugin-is-not-working/76723/2 "2017-02-28T06:57:05Z")

</div>

I think it's the namespace that's preventing this from working for you. I think the xml filter has an option for dealing with this. It was discussed here a few weeks ago.

> I have appended the xml with "" at every line, as It was difficult to post normal xml here.

Select the text and click the `</>` button on the toolbar to format it as preformatted text that keeps the angle brackets.

---

<div class="post-metadata">

**Author:** ![Ritesh\_Sharma](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@Ritesh\_Sharma](https://discuss.elastic.co/u/Ritesh_Sharma)\
**Post date:** [February 28, 2017, 7:38am UTC](https://discuss.elastic.co/t/xml-filter-plugin-is-not-working/76723/3 "2017-02-28T07:38:52Z")

</div>

Hi Magnus ,

are you talking about "namespaces" configuration ; i tried with following conf but the problem still persist ,

filter {

xml {  
store\_xml =\> "false"  
remove\_namespaces =\> "false"  
source =\> "message"  
namespaces =\> {  
"ns0" =\> "[http://SOME/URL/SOME.xsd](http://SOME/URL/SOME.xsd)"  
"ns1" =\> "[http://SOME/URL/SOME1.xsd](http://SOME/URL/SOME1.xsd)"  
}  
xpath =\> ["/LogRequest/Timestamp/text()", "mytime"]  
}

mutate {  
add\_field =\> ["time\_stamp", "%{mytime}"]  
}

}

I also tried with remove\_namespaces =\> "true" with same conf , but still getting the "time\_stamp" =\> "%{mytime}" as output .

Could you kindly provide any link to the last similar question , where you have mentioned the solution for such issue .

---

<div class="post-metadata">

**Author:** ![Ritesh\_Sharma](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@Ritesh\_Sharma](https://discuss.elastic.co/u/Ritesh_Sharma)\
**Post date:** [March 1, 2017, 1:35pm UTC](https://discuss.elastic.co/t/xml-filter-plugin-is-not-working/76723/4 "2017-03-01T13:35:56Z")

</div>

Well, i resolved this issue by doing following steps ,

- Removed the namespaces from Logstash processing ;

- Updated the X-path for Timestamp element ( i missed the header element , earlier )

;  
so now my configuration look like ,

filter {

xml {  
store\_xml =\> "false"  
remove\_namespaces =\> "true"  
source =\> "message"  
xpath =\>["//[localname()='LogRequest']/\*/[localname()='Timestamp']/text()", "mytime" ]

```
 }

```

}

So , essentially the updated X-path was the solution.

Cheers,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2017, 1:36pm UTC](https://discuss.elastic.co/t/xml-filter-plugin-is-not-working/76723/5 "2017-03-29T13:36:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.