# Xml filter Xpath nested fields

**URL:** <https://discuss.elastic.co/t/xml-filter-xpath-nested-fields/274190>\
**Category:** Logstash\
**Created:** [May 27, 2021, 11:12am UTC](https://discuss.elastic.co/t/xml-filter-xpath-nested-fields/274190 "2021-05-27T11:12:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![roua.B](https://avatars.discourse-cdn.com/v4/letter/r/91b2a8/32.png) [@roua.B](https://discuss.elastic.co/u/roua.B)\
**Post date:** [May 27, 2021, 11:12am UTC](https://discuss.elastic.co/t/xml-filter-xpath-nested-fields/274190/1 "2021-05-27T11:12:49Z")

</div>

Hello,  
I have an xml file witch is a collection of tags like this:

```auto
<COMMAND name="ADDRESS.WRITE" timestamp="1621246484916" so="14">
        <SVLOBJECT>
            <LONG name="ADR_SEQ" val="1"/>
            <LONG name="TTL_ID" val="1"/>
            <STRING name="ADR_LNAME" val="Soci?t? BenAmara pour la Mode"/>
            <STRING name="ADR_FNAME" val="Soci?t? BenAmara pour la Mode"/>
            <STRING name="ADR_STREET" val="AIN DERAHEM"/>
            <STRING name="ADR_STREETNO" val="0"/>
            <STRING name="ADR_ZIP" val="8100"/>
            <STRING name="ADR_CITY" val="JENDOUBA"/>
            <STRING name="LNG_CODE_PUB" val="FR"/>
            <STRING name="ADR_STATE" val="JENDOUBA"/>
            <STRING name="ADR_TAXNO" val="4402263N"/>
            <LONG name="IDTYPE_CODE" val="2"/>
            <STRING name="ADR_IDNO" val="01104833"/>
            <DATE name="ADR_BIRTHDT" year="1962" month="2" day="26"/>
            <STRING name="ADR_SOCIALSENO" val="01104833"/>
            <STRING name="ADR_DRIVELICENCE" val="2"/>
            <CHAR name="ADR_SEX" val="M"/>
            <CHAR name="ADR_CUSTTYPE" val="C"/>
            <STRING name="MAS_CODE_PUB" val="SING"/>
            <STRING name="ADR_NATIONALITY_PUB" val="TUN"/>
            <STRING name="CS_ID_PUB" val="CUST0009977556"/>
            <LONG name="COUNTRY_ID" val="1"/>
        </SVLOBJECT>
    </COMMAND>

```

my logstash filter is something like this:

```auto
 xml{
        source => "message"
        store_xml => false
        force_array => false
        xpath => ["/COMMAND/SVLOBJECT//*[not(name()='LIST')]/@name", "[Parameter][name]"]
        xpath => ["/COMMAND/SVLOBJECT//@val", "[Parameter][value]"]
    }

```

This works for attributes `name` and `val`, except I would like to have an object for `<DATE/>` element inside `[Parameter][value]`, maybe something like this:

` xpath => ["/COMMAND/SVLOBJECT//@*[local-name() = 'year' or local-name() = 'month' or local-name() = 'day']", "[Parameter][value][date]"]`

Except this does not parse the `<DATE/>` element at all.  
Is there a limit to nested field? If so, how would I go about adding this field in the right index of the `value` array?

Thank you for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 24, 2021, 11:13am UTC](https://discuss.elastic.co/t/xml-filter-xpath-nested-fields/274190/2 "2021-06-24T11:13:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.