# XML timestamp extraction?

**URL:** <https://discuss.elastic.co/t/xml-timestamp-extraction/193221>\
**Category:** Logstash\
**Created:** [July 31, 2019, 9:50pm UTC](https://discuss.elastic.co/t/xml-timestamp-extraction/193221 "2019-07-31T21:50:39Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![eclipsed450](https://avatars.discourse-cdn.com/v4/letter/e/b5e925/32.png) [@eclipsed450](https://discuss.elastic.co/u/eclipsed450)\
**Post date:** [July 31, 2019, 9:50pm UTC](https://discuss.elastic.co/t/xml-timestamp-extraction/193221/1 "2019-07-31T21:50:40Z")

</div>

I have the following in an XML event, and want to put it into it's own field, but none of the XMLPATH I've tried have worked. Help??

```auto
   <Event>
      <System>
            ...
            <TimeCreated SystemTime="2019-07-30T13:05:26.543836000Z" />
            ...
      </System>
            <EventData>
            ...
            </EventData>
   </Event>

```

---

<div class="post-metadata">

**Author:** ![eclipsed450](https://avatars.discourse-cdn.com/v4/letter/e/b5e925/32.png) [@eclipsed450](https://discuss.elastic.co/u/eclipsed450)\
**Post date:** [July 31, 2019, 11:35pm UTC](https://discuss.elastic.co/t/xml-timestamp-extraction/193221/2 "2019-07-31T23:35:04Z")

</div>

@Badger since you're so helpful 🙂

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 1, 2019, 12:36pm UTC](https://discuss.elastic.co/t/xml-timestamp-extraction/193221/3 "2019-08-01T12:36:53Z")

</div>

Try

```
xpath => { "/Event/System/TimeCreated/@SystemTime" => "foo" }
```

---

<div class="post-metadata">

**Author:** ![eclipsed450](https://avatars.discourse-cdn.com/v4/letter/e/b5e925/32.png) [@eclipsed450](https://discuss.elastic.co/u/eclipsed450)\
**Post date:** [August 1, 2019, 2:48pm UTC](https://discuss.elastic.co/t/xml-timestamp-extraction/193221/4 "2019-08-01T14:48:38Z")

</div>

> [@Badger](#):
>
> xpath =\> { "/Event/System/TimeCreated/@SystemTime" =\> "foo" }

Looks like that didn't work ☹

```auto
[ERROR] 2019-08-01 07:45:30.487 [Converge PipelineAction::Create<main>] xml - Invalid setting for xml filter plugin:

  filter {
    xml {
      # This setting must be a hash
      # This field must contain an even number of items, got 11
      xpath => ["/Event/System/EventID/text()", "System.EventID", "/Event/System/EventName/text()", "System.EventName", "/Event/System/Result/text()", "System.Result", "/Event/System/Channel/text()", "System.Channel", "/Event/System/Computer/text()", "System.Computer", ["/Event/System/TimeCreated/@SystemTime", "System.EventTime"]]
      ...
    }
  }
[ERROR] 2019-08-01 07:45:30.495 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Something is wrong with your configuration.", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb:87:in `config_init'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:126:in `initialize'", "org/logstash/plugins/PluginFactoryExt.java:81:in `filter_delegator'", "org/logstash/plugins/PluginFactoryExt.java:251:in `plugin'", "org/logstash/execution/JavaBasePipelineExt.java:50:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]} 

```

---

<div class="post-metadata">

**Author:** ![eclipsed450](https://avatars.discourse-cdn.com/v4/letter/e/b5e925/32.png) [@eclipsed450](https://discuss.elastic.co/u/eclipsed450)\
**Post date:** [August 1, 2019, 3:09pm UTC](https://discuss.elastic.co/t/xml-timestamp-extraction/193221/5 "2019-08-01T15:09:27Z")

</div>

I used `xpath => ["/Event/System/TimeCreated/@SystemTime", "System.EventTime"]` and it worked, thanks for pointing me in the right direction, again 🙂

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 1, 2019, 3:48pm UTC](https://discuss.elastic.co/t/xml-timestamp-extraction/193221/6 "2019-08-01T15:48:45Z")

</div>

> [@eclipsed450](#):
>
> # This setting must be a hash

If you use an array logstash will convert it to a hash using pairs of array entries. That is why it says it has to have an even number of entries.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 29, 2019, 3:48pm UTC](https://discuss.elastic.co/t/xml-timestamp-extraction/193221/7 "2019-08-29T15:48:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.