# XML PARSED

**URL:** <https://discuss.elastic.co/t/xml-parsed/176903>\
**Category:** Logstash\
**Created:** [April 15, 2019, 12:45pm UTC](https://discuss.elastic.co/t/xml-parsed/176903 "2019-04-15T12:45:35Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Diego\_Gutierrez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diego_gutierrez/32/43684_2.png) [@Diego\_Gutierrez](https://discuss.elastic.co/u/Diego_Gutierrez)\
**Post date:** [April 15, 2019, 12:45pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/1 "2019-04-15T12:45:35Z")

</div>

#ISSUE LOGSTASH PARSE XML

Hi, I've a problem parsing xml response from API (http\_poller). I receive a weird xml response and idk how I can parse it. My file.conf is this:

 ![imagen](https://us1.discourse-cdn.com/elastic/original/3X/a/3/a3d1e0be7b22f6a4685fe33e356ad8bb606f9580.png)

The API response is(postman image):  
 ![imagen](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fbee9fb2cfac0c3433556ad1b12585684c49cfbf.png)

I want to get only the six marked fields on the photo ingest in Elasticsearch. I've made this filter to parse the response:

 ![imagen](https://us1.discourse-cdn.com/elastic/original/3X/4/5/4572089bd95da4175e922fe93f7c3a2e054aaa5d.png)

And the response I get it is like:

 ![imagen](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c9ee22d8ee59e728344e99ecfc77d068866d8772.png)

Someone can help me please? 🙂

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 15, 2019, 1:04pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/2 "2019-04-15T13:04:10Z")

</div>

Please do not post pictures of text. Just post the text.

fm.alarmObject is also an array, so you need a [0] after it.

---

<div class="post-metadata">

**Author:** ![Diego\_Gutierrez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diego_gutierrez/32/43684_2.png) [@Diego\_Gutierrez](https://discuss.elastic.co/u/Diego_Gutierrez)\
**Post date:** [April 15, 2019, 1:21pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/3 "2019-04-15T13:21:34Z")

</div>

Sorry, i did cause there are a lot of text.

Doesn`t work your response, maybe I've not explain good.

I want to get a final output like:

{  
"@version" =\> "1",  
"@timestamp" =\> 2019-04-15T13:14:05.431Z,  
"severity"=\>"info"  
"alarmName" =\>"363"  
"nodeName"=\> "LSTORRELODJA0"  
.......  
}

for each of the alarms of the response.

Thanks so much for u time 🙂

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 15, 2019, 1:50pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/4 "2019-04-15T13:50:22Z")

</div>

You have store\_xml true, so instead of using xpath you could use mutate

```
 mutate { add_field => { "alarmas" => "%{[Body][0][findResponse][0][Result][...and so on]}" } }
```

---

<div class="post-metadata">

**Author:** ![Diego\_Gutierrez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diego_gutierrez/32/43684_2.png) [@Diego\_Gutierrez](https://discuss.elastic.co/u/Diego_Gutierrez)\
**Post date:** [April 15, 2019, 3:01pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/5 "2019-04-15T15:01:05Z")

</div>

> [@Badger](#):
>
> You have store\_xml true, so instead of using xpath you could use mutate

mmm nothing.

I get the string like "alarma" =\> "%{[Body][0][findResponse][0]}" but not values.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 15, 2019, 3:23pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/6 "2019-04-15T15:23:31Z")

</div>

So starting off with

```
mutate { add_field => { "alarmName" => "%{[alarmas][Body][0][findResponse][0][result][0]}" } }

```

what do you get. Please post text, not a picture.

---

<div class="post-metadata">

**Author:** ![Diego\_Gutierrez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diego_gutierrez/32/43684_2.png) [@Diego\_Gutierrez](https://discuss.elastic.co/u/Diego_Gutierrez)\
**Post date:** [April 16, 2019, 8:20am UTC](https://discuss.elastic.co/t/xml-parsed/176903/7 "2019-04-16T08:20:42Z")

</div>

> [@Badger](#):
>
> %{[alarmas][Body][0][findResponse][0][result][0]

I get the following response:

logstash\_testdiego | {  
logstash\_testdiego | "@timestamp" =\> 2019-04-16T08:09:39.057Z,  
logstash\_testdiego | "@version" =\> "1",  
logstash\_testdiego | "tags" =\> [  
logstash\_testdiego | [0] "multiline"  
logstash\_testdiego | ],  
logstash\_testdiego | "alarmaEvent" =\> "{"fm.AlarmObject":[{"severity":["info"],"nodeName":["LSTORRELODJA0"],"al armClassTag":["radiusaccounting.RadiusAcctPlcyFailure"],"probableCause":["260"],"alarmName":["363"],"lastTimeDetec ted":["1555352020018"],"type":["38"]},{"severity":["info"],"nodeName":["LSCANDELARGEN2"],"alarmClassTag":["n etw.FileTransferFailure"],"probableCause":["89"],

the filter is:

filter{

xml {  
source =\> "message"  
store\_xml =\> true  
target =\> "alarmas"  
# xpath =\> [  
# "/alarmas/Body[0]/findResponse[0]/result[0]/fm.AlarmObject[0]/alarmName", "alarm\_Name"  
# ]  
}

mutate {

add\_field =\> { "alarmaEvent" =\> "%{[alarmas][Body][0][findResponse][0][result][0]}" }  
remove\_field =\> ["message","host", "http\_poller\_metadata", "alarmas"]  
}

}

---

<div class="post-metadata">

**Author:** ![Diego\_Gutierrez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diego_gutierrez/32/43684_2.png) [@Diego\_Gutierrez](https://discuss.elastic.co/u/Diego_Gutierrez)\
**Post date:** [April 16, 2019, 9:37am UTC](https://discuss.elastic.co/t/xml-parsed/176903/8 "2019-04-16T09:37:19Z")

</div>

Now I get this:

logstash\_testdiego | {  
logstash\_testdiego | "@version" =\> "1",  
logstash\_testdiego | "@timestamp" =\> 2019-04-16T09:24:37.860Z,  
logstash\_testdiego | "severity" =\> [  
logstash\_testdiego | [0] "info",  
logstash\_testdiego | [1] "info",  
logstash\_testdiego | [2] "info",  
logstash\_testdiego | [3] "info",  
logstash\_testdiego | [4] "minor",

with the next filter code:

filter{

xml {  
source =\> "message"  
remove\_namespaces =\> true  
store\_xml =\> false  
# target =\> "alarmas"  
xpath =\> [  
"//Header/header/requestID/text()", "IdRequest",  
"//Body/findResponse/result/fm.AlarmObject/severity/text()", "severity"  
]  
}

if [IdRequest] { mutate { replace =\> { "IdRequest" =\> "%{[IdRequest][0]}" } } }

mutate {  
remove\_field =\> ["message","host", "http\_poller\_metadata"]  
}

}

But i want to get a diferent doc per each severity record. Like:

logstash\_testdiego | {  
logstash\_testdiego | "@version" =\> "1",  
logstash\_testdiego | "@timestamp" =\> 2019-04-16T09:24:37.860Z,  
logstash\_testdiego | "severity" =\> [  
logstash\_testdiego | [0] "info"  
logstash\_testdiego | }

logstash\_testdiego | {  
logstash\_testdiego | "@version" =\> "1",  
logstash\_testdiego | "@timestamp" =\> 2019-04-16T09:24:37.860Z,  
logstash\_testdiego | "severity" =\> [  
logstash\_testdiego | [1] "info"  
logstash\_testdiego | }

....

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 16, 2019, 12:36pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/9 "2019-04-16T12:36:45Z")

</div>

Once you have an array called severity you can us a split filter to create multiple events

```
split { field => "severity" }
```

---

<div class="post-metadata">

**Author:** ![Diego\_Gutierrez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diego_gutierrez/32/43684_2.png) [@Diego\_Gutierrez](https://discuss.elastic.co/u/Diego_Gutierrez)\
**Post date:** [April 17, 2019, 10:46am UTC](https://discuss.elastic.co/t/xml-parsed/176903/10 "2019-04-17T10:46:56Z")

</div>

yes its work. But i need something more.  
Because I've more one field to split.

my XML config is:

```
xml {
    source => "message"
    remove_namespaces => true
    store_xml => false
    target => "alarmas"
    xpath => [
            "//severity/text()", "severity",
            "//alarmName/text()", "alarmName"
  ] 

 }

```

So i've need diferent doc with all fields:  
my input xml is:

```
<SOAP:Envelope xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/">
    <SOAP:Header>
        <header xmlns="xmlapi_1.0">
            <requestID>samostats@954345</requestID>
            <requestTime>Apr 17, 2019 11:08:19 AM</requestTime>
            <responseTime>Apr 17, 2019 11:08:19 AM</responseTime>
        </header>
    </SOAP:Header>
    <SOAP:Body>
        <findResponse xmlns="xmlapi_1.0">
            <result>
                <fm.AlarmObject>
                    <severity>info</severity>
                    <probableCause>260</probableCause>
                    <alarmName>363</alarmName>
                    <type>38</type>
                    <lastTimeDetected>1555352020018</lastTimeDetected>
                    <nodeName>LSTORRELODJA0</nodeName>
                    <alarmClassTag>radiusaccounting.RadiusAcctPlcyFailure</alarmClassTag>
                    <children-Set></children-Set>
                </fm.AlarmObject>
                <fm.AlarmObject>
                    <severity>info</severity>
                    <probableCause>89</probableCause>
                    <alarmName>8152</alarmName>
                    <type>4</type>
                    <lastTimeDetected>1549357659055</lastTimeDetected>
                    <nodeName>LSCANDELARGEN2</nodeName>
                    <alarmClassTag>netw.FileTransferFailure</alarmClassTag>
                    <children-Set></children-Set>
                </fm.AlarmObject>
                <fm.AlarmObject>
                    <severity>info</severity>
                    <probableCause>400</probableCause>
                    <alarmName>528</alarmName>
                    <type>45</type>
                    <lastTimeDetected>1543426495541</lastTimeDetected>
                    <nodeName>lssamma4</nodeName>
                    <alarmClassTag>schedule.scheduledTaskCompletionStatus</alarmClassTag>
                    <children-Set></children-Set>
                </fm.AlarmObject>
            </result>
        </findResponse>
    </SOAP:Body>
</SOAP:Envelope>

```

I want a doc per each \<fm.AlarmObject\>  
so i expect

```
{
"@version" =&gt; "1",
"@timestamp" =&gt; 2019-04-15T13:14:05.431Z,
"severity"=&gt;"info"
"alarmName" =&gt;"363"
.......
},
{
"@version" =&gt; "1",
"@timestamp" =&gt; 2019-04-15T13:14:05.431Z,
"severity"=&gt;"info"
"alarmName" =&gt;"8152"
.......
},
{
"@version" =&gt; "1",
"@timestamp" =&gt; 2019-04-15T13:14:05.431Z,
"severity"=&gt;"info"
"alarmName" =&gt;"528"
.......
}

```

but if I use:

```
split { field => "severity" }
split { field => "alarmName" }

```

my output is:

```
 {
logstash_testdiego | "alarmName" => "363",
logstash_testdiego | "@timestamp" => 2019-04-17T10:41:36.451Z,
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "@version" => "1"
logstash_testdiego | }
logstash_testdiego | {
logstash_testdiego | "alarmName" => "8152",
logstash_testdiego | "@timestamp" => 2019-04-17T10:41:36.451Z,
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "@version" => "1"
logstash_testdiego | }
logstash_testdiego | {
logstash_testdiego | "alarmName" => "528",
logstash_testdiego | "@timestamp" => 2019-04-17T10:41:36.451Z,
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "@version" => "1"
logstash_testdiego | }
logstash_testdiego | {
logstash_testdiego | "alarmName" => "363",
logstash_testdiego | "@timestamp" => 2019-04-17T10:41:36.451Z,
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "@version" => "1"
logstash_testdiego | }
logstash_testdiego | {
logstash_testdiego | "alarmName" => "8152",
logstash_testdiego | "@timestamp" => 2019-04-17T10:41:36.451Z,
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "@version" => "1"
logstash_testdiego | }
logstash_testdiego | {
logstash_testdiego | "alarmName" => "528",
logstash_testdiego | "@timestamp" => 2019-04-17T10:41:36.451Z,
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "@version" => "1"
logstash_testdiego | }
logstash_testdiego | {
logstash_testdiego | "alarmName" => "363",
logstash_testdiego | "@timestamp" => 2019-04-17T10:41:36.451Z,
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "@version" => "1"
logstash_testdiego | }
logstash_testdiego | {
logstash_testdiego | "alarmName" => "8152",
logstash_testdiego | "@timestamp" => 2019-04-17T10:41:36.451Z,
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "@version" => "1"
logstash_testdiego | }
logstash_testdiego | {
logstash_testdiego | "alarmName" => "528",
logstash_testdiego | "@timestamp" => 2019-04-17T10:41:36.451Z,
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "@version" => "1"
logstash_testdiego | }

```

I expect only 3 docs but i've received a combination per each field with the other. And i cant create a array with split ☹

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 17, 2019, 12:34pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/11 "2019-04-17T12:34:25Z")

</div>

Your post is unreadable. You XML is being interpreted as HTML tags so none of the elements actually appear in the post. Edit your posts and either select the XML (or configuration) and click on \</\> in the toolbar above the edit pane to treat it as a block quote, or surround the lines of XML with lines containing just three backticks...

````
```
````

---

<div class="post-metadata">

**Author:** ![Diego\_Gutierrez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diego_gutierrez/32/43684_2.png) [@Diego\_Gutierrez](https://discuss.elastic.co/u/Diego_Gutierrez)\
**Post date:** [April 17, 2019, 12:48pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/12 "2019-04-17T12:48:42Z")

</div>

Sorry is my first post in this discuss.  
Now is better?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 17, 2019, 2:17pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/13 "2019-04-17T14:17:49Z")

</div>

Much better. Does

```
    xml {
        source => "message"
        remove_namespaces => true
        store_xml => true
        target => "alarmas"
        force_array => false
        remove_field => ["message"]
    }
    split { field => "[alarmas][Body][findResponse][result][fm.AlarmObject]" }

```

work for you?

---

<div class="post-metadata">

**Author:** ![Diego\_Gutierrez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diego_gutierrez/32/43684_2.png) [@Diego\_Gutierrez](https://discuss.elastic.co/u/Diego_Gutierrez)\
**Post date:** [April 17, 2019, 2:21pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/14 "2019-04-17T14:21:39Z")

</div>

I got it with the following way:

```
filter{
  ## interpret the message payload as XML
  xml {
    source => "message"
    remove_namespaces => true
    store_xml => false
    target => "alarmas"
    xpath => {"//fm.AlarmObject" => "alarma"}

 }

  split { field => "alarma"}

  mutate {
  gsub=>["alarma", "\n", ""]
  # split=>{"alarma" => "\n"}

  remove_field => ["message","host", "http_poller_metadata","alarmas", "tags"] 
  }

  xml {
    source => "alarma"
    remove_namespaces => true
    store_xml => false
    # target => "alarms"
    xpath => [
      "//severity/text()" , "severity",
      "//probableCause/text()" , "probableCause",
      "//alarmName/text()" , "alarmName",
      "//type/text()" , "type",
      "//alarmClassTag/text()" , "alarmClassTag",
      "//nodeName/text()" , "NodeName"
    ]

 }

 mutate{
   remove_field => ["alarma"]
 }
 mutate { replace => [ 
   "severity", "%{[severity][0]}",
   "probableCause", "%{[probableCause][0]}",
   "alarmName", "%{[alarmName][0]}",
   "type", "%{[type][0]}",
   "alarmClassTag", "%{[alarmClassTag][0]}",
   "NodeName","%{[NodeName][0]}"
   ] } 

}

```

maybe my way is not the best to the processing speed but i get the result like i want it:

```
logstash_testdiego | {
logstash_testdiego | "type" => "38",
logstash_testdiego | "alarmClassTag" => "radiusaccounting.RadiusAcctPlcyFailure",
logstash_testdiego | "@timestamp" => 2019-04-17T14:11:48.664Z,
logstash_testdiego | "@version" => "1",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "probableCause" => "260",
logstash_testdiego | "alarmName" => "363",
logstash_testdiego | "NodeName" => "LSTORRELODJA0",
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml"
logstash_testdiego | }
logstash_testdiego | {
logstash_testdiego | "type" => "4",
logstash_testdiego | "alarmClassTag" => "netw.FileTransferFailure",
logstash_testdiego | "@timestamp" => 2019-04-17T14:11:48.664Z,
logstash_testdiego | "@version" => "1",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "probableCause" => "89",
logstash_testdiego | "alarmName" => "8152",
logstash_testdiego | "NodeName" => "LSCANDELARGEN2",
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml"
logstash_testdiego | }
logstash_testdiego | {
logstash_testdiego | "type" => "45",
logstash_testdiego | "alarmClassTag" => "schedule.scheduledTaskCompletionStatus",
logstash_testdiego | "@timestamp" => 2019-04-17T14:11:48.664Z,
logstash_testdiego | "@version" => "1",
logstash_testdiego | "severity" => "info",
logstash_testdiego | "probableCause" => "400",
logstash_testdiego | "alarmName" => "528",
logstash_testdiego | "NodeName" => "lssamma4",
logstash_testdiego | "path" => "/usr/share/logstash/datos/gestores/file.xml"
logstash_testdiego | }

```

anyway i will try with ur solution. Thanks so much to the patience with me jejejejej

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2019, 2:21pm UTC](https://discuss.elastic.co/t/xml-parsed/176903/15 "2019-05-15T14:21:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.