# Xml parcing problem

**URL:** <https://discuss.elastic.co/t/xml-parcing-problem/184725>\
**Category:** Logstash\
**Created:** [June 7, 2019, 9:22am UTC](https://discuss.elastic.co/t/xml-parcing-problem/184725 "2019-06-07T09:22:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![taku](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@taku](https://discuss.elastic.co/u/taku)\
**Post date:** [June 7, 2019, 9:22am UTC](https://discuss.elastic.co/t/xml-parcing-problem/184725/1 "2019-06-07T09:22:00Z")

</div>

Hello everyone, I'm trying to parse the xml file, but the logstach configuration fails below, their hml needs to pull out only the value of the web container, but for some reason everything gets into the message field

```
xml {
 target => "doc"
 store_xml +> false
 source => "message"
 xpath => ["/Stats/@name", "name"]
 xpath => ["/Stats/BRS/@cur", "Current"]
}
 xml file is bellow
    indent preformatted text by 4 spaces
<?xml version="1.0" encoding="UTF-8"?>
<Snapshot time="1559836472362">
<Stats name="WMQJCAResourceAdapter" statType="threadPoolModule" il="-2" type="COLLECTION">
<BRS id="3" lWM="0" hWM="1" cur="0" int="967.0" sT="1559799678760" lST="1559836472143" lB="0" uB="0">
</BRS>
<BRS id="4" lWM="1" hWM="10" cur="1" int="1.9528504E7" sT="1559799678760" lST="1559836472143" lB="10" uB="50">
</BRS>
<CS id="6" sT="1559799711817" lST="1559799711817" ct="0">
</CS>
<CS id="7" sT="1559799711817" lST="1559799711817" ct="0">
</CS>
<RS id="8" sT="1559799711817" lST="1559836472143" lWM="0" hWM="0" cur="0" int="0.0"></RS>
</Stats>
<Stats name="WebContainer" statType="threadPoolModule" il="-2" type="COLLECTION">
<BRS id="3" lWM="1" hWM="76" cur="73" int="1.38463928E8" sT="1559799674049" lST="1559836472143" lB="0" uB="0">
</BRS>
<BRS id="4" lWM="1" hWM="76" cur="76" int="1.132993425E9" sT="1559799674049" lST="1559836472143" lB="50" uB="500">
</BRS>
<CS id="6" sT="1559799711817" lST="1559799711817" ct="0">
</CS>
<CS id="7" sT="1559799711817" lST="1559799711817" ct="0">
</CS>
<RS id="8" sT="1559799711817" lST="1559836472143" lWM="0" hWM="0" cur="0" int="0.0"></RS>
</Stats>
<Stats name="WorkManager.AsynchLogWriteWorkManager" statType="threadPoolModule" il="-2" type="COLLECTION">
<BRS id="3" lWM="0" hWM="300" cur="205" int="8.59293321E8" sT="1559808597889" lST="1559836472143" lB="0" uB="0">
</BRS>
<BRS id="4" lWM="1" hWM="300" cur="212" int="1.74246295E9" sT="1559808597889" lST="1559836472143" lB="100" uB="300">
</BRS>
<CS id="6" sT="1559808597889" lST="1559836395703" ct="126">
</CS>
<CS id="7" sT="1559808597889" lST="1559808597889" ct="0">
</CS>
<RS id="8" sT="1559808597889" lST="1559836395703" lWM="1" hWM="126" cur="126" int="6.86019366E8"></RS>
</Stats>
</Snapshot>

```

but in index all information in message

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 7, 2019, 1:05pm UTC](https://discuss.elastic.co/t/xml-parcing-problem/184725/2 "2019-06-07T13:05:48Z")

</div>

You need to include Snapshot in the xpath values

```
    xml {
        target => "doc"
        store_xml => false
        source => "message"
        xpath => {
            "/Snapshot/Stats/@name" => "name"
            "/Snapshot/Stats/BRS/@cur" => "Current"
        }
    }

```

The xpath option expects a hash. Specifying an option multiple times will work in every case except where it does not work. In that case it will confuse the hell of you. It does not matter in this case, but using an option only once is a good habit to get into.

---

<div class="post-metadata">

**Author:** ![taku](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@taku](https://discuss.elastic.co/u/taku)\
**Post date:** [June 10, 2019, 12:30pm UTC](https://discuss.elastic.co/t/xml-parcing-problem/184725/3 "2019-06-10T12:30:25Z")

</div>

I tried your config, but it does not work, all the fields to into the message

I simplified the task and left the most minimal and even with it all the parameters come in the message field

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/c/5cde3bf953a061c11a65ce482c007539c3fd1442.png)  
in fact, I need only parameter cur="73" if Stats name="WebContainer" and BRS id="3" need to pull out these values, I tried everything but nothing helps

---

<div class="post-metadata">

**Author:** ![taku](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@taku](https://discuss.elastic.co/u/taku)\
**Post date:** [June 11, 2019, 2:02pm UTC](https://discuss.elastic.co/t/xml-parcing-problem/184725/4 "2019-06-11T14:02:14Z")

</div>

I try it  
/Snapshot/Stats[@name='WebContainer']/BRS[@id='4']/@cur  
in this work very goot

> **[Best Online XPath Tester and Evaluator](https://codebeautify.org/Xpath-Tester#)**
>
> XPath tester is free online tool helps to test your expressions/queries against an XML data, file, url

  
but not work in logstash.  
"/Snapshot/Stats[@name='WebContainer']/BRS[@id='4']/@cur", "WebContainer"  
all info go to message

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 11, 2019, 3:05pm UTC](https://discuss.elastic.co/t/xml-parcing-problem/184725/5 "2019-06-11T15:05:46Z")

</div>

It works in logstash as well.

```
    xml {
        target => "doc"
        store_xml => false
        source => "message"
        force_array => false
        xpath => {
            "/Snapshot/Stats/@name" => "name"
            "/Snapshot/Stats[@name='WebContainer']/BRS[@id='4']/@cur" => "Current"
        }
    }

```

produces

```
      "name" => [
    [0] "WMQJCAResourceAdapter",
    [1] "WebContainer",
    [2] "WorkManager.AsynchLogWriteWorkManager"
],
   "Current" => "76",

```

in 7.1.1

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2019, 3:05pm UTC](https://discuss.elastic.co/t/xml-parcing-problem/184725/6 "2019-07-09T15:05:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.