# XML mapping of IDs with Logstash

**URL:** https://discuss.elastic.co/t/xml-mapping-of-ids-with-logstash/155197
**Category:** Logstash
**Created:** [November 2, 2018, 3:55pm UTC](https://discuss.elastic.co/t/xml-mapping-of-ids-with-logstash/155197 "2018-11-02T15:55:30Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ChristianCH](https://avatars.discourse-cdn.com/v4/letter/c/67e7ee/32.png) [@ChristianCH](https://discuss.elastic.co/u/ChristianCH)
#### Post date: [November 2, 2018, 3:55pm UTC](https://discuss.elastic.co/t/xml-mapping-of-ids-with-logstash/155197/1 "2018-11-02T15:55:30Z")

</div>

Hi all,

I want to insert chats into Elasticsearch and have a problem in converting the chat XML transcript to the proper JSON using logstash.

This is the XML:

```
<?xml version="1.0" encoding="UTF-8"?>
<chatTranscript>
	<newParty userId="123">
		<userInfo userNick="A" userType="CLIENT" />
	</newParty>
	<message userId="123">
		<msgText>This is just a text from A</msgText>
	</message>
	<newParty userId="456">
		<userInfo userNick="B" userType="AGENT" />
	</newParty>
	<message userId="456">
		<msgText>This is a text from B</msgText>
	</message>
	<newParty userId="789">
		<userInfo userNick="C" userType="AGENT" />
	</newParty>
	<message userId="789">
		<msgText>This is a text from C</msgText>
	</message>
	<message userId="123">
		<msgText>This is a reply from A</msgText>
	</message>
	<message userId="789">
		<msgText>This is another text from C</msgText>
	</message>
</chatTranscript>

```

This is my basic starting Logstash config to test with:  
input { stdin {  
}  
}

```
filter {

	xml {
		source => "message"
		target => "doc"
		
		store_xml => true
		force_array => false
		remove_namespaces =>true   	

	
	}
	
	mutate
	{
		remove_field => ["message","host"]
	}
}

output { stdout { codec => rubydebug } }

```

This is the output of the JSON:

```
{
    "@timestamp" => 2018-11-02T15:31:14.901Z,
      "@version" => "1",
           "doc" => {
         "message" => [
            [0] {
                 "userId" => "123",
                "msgText" => "This is just a text from A"
            },
            [1] {
                 "userId" => "456",
                "msgText" => "This is a text from B"
            },
            [2] {
                 "userId" => "789",
                "msgText" => "This is a text from C"
            },
            [3] {
                 "userId" => "123",
                "msgText" => "This is a reply from A"
            },
            [4] {
                 "userId" => "789",
                "msgText" => "This is another text from C"
            }
        ],
        "newParty" => [
            [0] {
                "userInfo" => {
                    "userNick" => "A",
                    "userType" => "CLIENT"
                },
                  "userId" => "123"
            },
            [1] {
                "userInfo" => {
                    "userNick" => "B",
                    "userType" => "AGENT"
                },
                  "userId" => "456"
            },
            [2] {
                "userInfo" => {
                    "userNick" => "C",
                    "userType" => "AGENT"
                },
                  "userId" => "789"
            }
        ]
    }
}

```

What I want to achieve is, that in the message fields there isn't the userID, but the userNickName being stored to ElasticSearch.

How could I match those fields together?

Thanks in advance.

Regards,  
Christian

---

<div class="post-metadata">

### Author: ![ChristianCH](https://avatars.discourse-cdn.com/v4/letter/c/67e7ee/32.png) [@ChristianCH](https://discuss.elastic.co/u/ChristianCH)
#### Post date: [November 6, 2018, 6:59am UTC](https://discuss.elastic.co/t/xml-mapping-of-ids-with-logstash/155197/2 "2018-11-06T06:59:37Z")

</div>

Hi all,

Any ideas how to achieve this?

Regards,  
Christian

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 4, 2018, 6:59am UTC](https://discuss.elastic.co/t/xml-mapping-of-ids-with-logstash/155197/3 "2018-12-04T06:59:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.