# Xml filter: Unable to get parent and child attributes in one row

**URL:** <https://discuss.elastic.co/t/xml-filter-unable-to-get-parent-and-child-attributes-in-one-row/114643>\
**Category:** Logstash\
**Created:** [January 9, 2018, 6:07am UTC](https://discuss.elastic.co/t/xml-filter-unable-to-get-parent-and-child-attributes-in-one-row/114643 "2018-01-09T06:07:11Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [January 10, 2018, 11:00am UTC](https://discuss.elastic.co/t/xml-filter-unable-to-get-parent-and-child-attributes-in-one-row/114643/7 "2018-01-10T11:00:51Z")

</div>

Maybe. If you really got to know XPath.

It seems to me that you want separate events for each `test-case` but with the @name of `test-suite` carried into each `test-case` event.

I think this can be done. It would involve two xml filter stages with a `split` filter in between.  
Use this [online XPath tester](https://www.freeformatter.com/xpath-tester.html#ad-output)

1. 1st xml filter, add two fields  
`"//test-case/../../@name", "suitename",`  
`"//test-case", "test-cases"`
2. Split filter, split on `test-cases`  
`field => "test-cases"`  
`target => "test-case"`  
this should create X number of new events all with `suitename` and `test-case` with xml content`.
3. 2nd xml filter, add the other fields.  
`"/test-case/@name", "testcase",`  
`"/test-case/@result", "res",`  
`"/test-case/reason/@name","reasonattr",`  
`"/test-case/@time", "timetest"`  
Remember to drop any fields you no longer need.  
Now elasticsearch and kibana have a single doc structure of test case to work with.

Good Luck.

---

_[View the full topic](https://discuss.elastic.co/t/xml-filter-unable-to-get-parent-and-child-attributes-in-one-row/114643)._