# XML parsing- Filter to format a date field

**URL:** https://discuss.elastic.co/t/xml-parsing-filter-to-format-a-date-field/170036
**Category:** Logstash
**Created:** [February 26, 2019, 3:26pm UTC](https://discuss.elastic.co/t/xml-parsing-filter-to-format-a-date-field/170036 "2019-02-26T15:26:28Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Skwilly](https://avatars.discourse-cdn.com/v4/letter/s/5f8ce5/32.png) [@Skwilly](https://discuss.elastic.co/u/Skwilly)
#### Post date: [February 26, 2019, 3:26pm UTC](https://discuss.elastic.co/t/xml-parsing-filter-to-format-a-date-field/170036/1 "2019-02-26T15:26:28Z")

</div>

Hi,

I have the following index:

```
"hits" : [
  {
    "_index" : "test",
    "_type" : "doc",
    "_id" : "OWZhKmkBDjX7TOqqZgwX",
    "_score" : 1.0,
    "_source" : {
      "@timestamp" : "2019-02-26T15:16:52.527Z"
      "theXML" : {
        "statistics" : {
          "total" : {
            "stat" : [
              {
                "pass" : "1",
                "content" : "Critical Tests",
                "fail" : "0"
              },
              {
                "pass" : "1",
                "content" : "All Tests",
                "fail" : "0"
              }
            ]
          },
          "suite" : {
            "stat" : {
              "pass" : "1",
              "content" : "Test1",
              "id" : "s1",
              "name" : "Test1",
              "fail" : "0"
            }
          }
        },
        "errors" : { },
        "generated" : "20190215 15:03:20.437",
        "generator" : "Robot 3.0.3.dev20170213 (Python 2.7.15 on win32)",
        "suite" : {
          "status" : {
            "starttime" : "20190215 15:03:20.444",
            "endtime" : "20190215 15:03:44.198",
            "status" : "PASS"
          },

```

And I would like the "endtime" and "starttime" fields to be formatted at date (as opposed to strings).

I had the following filter which did not work:

```
filter {
xml { source => "message" target => "theXML" store_xml => true force_array => false }
split { field => "[theXML][suite][test][kw]" remove_field => "message"}
date {match => ["%{[theXML][suite][status][endtime]}", "yyyyMMdd HH:mm:ss.SSS"}
date {match => ["%{[theXML][suite][status][endtime]}", "yyyyMMdd HH:mm:ss.SSS"}
}

```

When I check the mapping of this index, starttime and endtime are still stored as string.

Could you point out what I am doing wrong here ?

Thank you in advance,

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 26, 2019, 3:33pm UTC](https://discuss.elastic.co/t/xml-parsing-filter-to-format-a-date-field/170036/2 "2019-02-26T15:33:39Z")

</div>

> [@Skwilly](#):
>
> date {match =\> ["%{[theXML][suite][status][endtime]}", "yyyyMMdd HH:mm:ss.SSS"}

You are missing a ] before the final }.

That will parse endtime and store the result in @timestamp. If you want to overwrite endtime than add

```
target => "[theXML][suite][status][endtime]"

```

That will not fix the mapping on the existing index, but once you roll to a new index it should start appearing as a date.

However, the @timestamp on your message does not match either startime or endtime, so there is something else happening here.

---

<div class="post-metadata">

### Author: ![Skwilly](https://avatars.discourse-cdn.com/v4/letter/s/5f8ce5/32.png) [@Skwilly](https://discuss.elastic.co/u/Skwilly)
#### Post date: [February 26, 2019, 4:07pm UTC](https://discuss.elastic.co/t/xml-parsing-filter-to-format-a-date-field/170036/3 "2019-02-26T16:07:20Z")

</div>

Thanks, I was indeed missing a bracket..

However, after deleting the index and fixing the configuration file, which is now:

```
filter {
xml { source => "message" target => "theXML" store_xml => true force_array => false }
split { field => "[theXML][suite][test][kw]" remove_field => "message"}
date {match => ["%{[theXML][suite][status][endtime]}", "yyyyMMdd HH:mm:ss.SSS"] target => "[theXML][suite][status][endtime]"}
date {match => ["%{[theXML][suite][status][starttime]}", "yyyyMMdd HH:mm:ss.SSS"] target => "[theXML][suite][status][starttime]" }
}

```

The endtime and starttime fields are still stored as strings after reindexing.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 26, 2019, 4:23pm UTC](https://discuss.elastic.co/t/xml-parsing-filter-to-format-a-date-field/170036/4 "2019-02-26T16:23:16Z")

</div>

> [@Skwilly](#):
>
> "%{[theXML][suite][status][endtime]}"

Remove the %{}

---

<div class="post-metadata">

### Author: ![Skwilly](https://avatars.discourse-cdn.com/v4/letter/s/5f8ce5/32.png) [@Skwilly](https://discuss.elastic.co/u/Skwilly)
#### Post date: [February 26, 2019, 4:30pm UTC](https://discuss.elastic.co/t/xml-parsing-filter-to-format-a-date-field/170036/5 "2019-02-26T16:30:07Z")

</div>

Thanks, that did it!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 26, 2019, 4:36pm UTC](https://discuss.elastic.co/t/xml-parsing-filter-to-format-a-date-field/170036/6 "2019-03-26T16:36:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.