# XML to Elasticsearch via Logstash

**URL:** <https://discuss.elastic.co/t/xml-to-elasticsearch-via-logstash/120726>\
**Category:** Logstash\
**Created:** [February 20, 2018, 9:13pm UTC](https://discuss.elastic.co/t/xml-to-elasticsearch-via-logstash/120726 "2018-02-20T21:13:52Z")\
**Posts on this page:** 8\
**Page:** 3

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 3, 2018, 4:53pm UTC](https://discuss.elastic.co/t/xml-to-elasticsearch-via-logstash/120726/42 "2018-03-03T16:53:28Z")

</div>

**What does the event look like?** Use a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![Errors](https://avatars.discourse-cdn.com/v4/letter/e/a9adbd/32.png) [@Errors](https://discuss.elastic.co/u/Errors)\
**Post date:** [March 4, 2018, 4:41am UTC](https://discuss.elastic.co/t/xml-to-elasticsearch-via-logstash/120726/43 "2018-03-04T04:41:26Z")

</div>

Hi wwalker,  
Unfortunately I'm unable to apply the conversion (I get the same error so it never proceeds to that step). I think the way I'm referencing the variable is wrong - see post 39!

---

<div class="post-metadata">

**Author:** ![Errors](https://avatars.discourse-cdn.com/v4/letter/e/a9adbd/32.png) [@Errors](https://discuss.elastic.co/u/Errors)\
**Post date:** [March 4, 2018, 4:42am UTC](https://discuss.elastic.co/t/xml-to-elasticsearch-via-logstash/120726/44 "2018-03-04T04:42:57Z")

</div>

The output I've provided you with is actually whats produced when I have `stdout { codec => rubydebug }` set haha, so I'm a bit unsure of what exactly you're after?  
Some of the data is pushed successfully to elasticsearch so it's displayed in the normal JSON-esque format in the output, however when there's an issue, the error msg I pasted in post 39 is what appears

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 4, 2018, 9:49am UTC](https://discuss.elastic.co/t/xml-to-elasticsearch-via-logstash/120726/45 "2018-03-04T09:49:41Z")

</div>

> so I'm a bit unsure of what exactly you're after?

I am obviously interested in seeing the event that ES rejects. What you posted earlier doesn't include the LISTED\_ON field that it complains about.

> Some of the data is pushed successfully to elasticsearch so it's displayed in the normal JSON-esque format in the output, however when there's an issue, the error msg I pasted in post 39 is what appears

So comment the elasticsearch output so you always get the raw event dumped to stdout. Until we can get the LISTED\_ON field in shape the elasticsearch output is an irrelevant distraction.

---

<div class="post-metadata">

**Author:** ![Errors](https://avatars.discourse-cdn.com/v4/letter/e/a9adbd/32.png) [@Errors](https://discuss.elastic.co/u/Errors)\
**Post date:** [March 4, 2018, 10:19am UTC](https://discuss.elastic.co/t/xml-to-elasticsearch-via-logstash/120726/46 "2018-03-04T10:19:44Z")

</div>

Ah my bad! I didn't realise you called them events haha. It looks something like this:

```
<INDIVIDUAL>
    <DATA>1212121</DATA>
    <VERSION>1</VERSION>
    <FIRST_NAME>John Doe</FIRST_NAME>
    <LIST_TYPE>AAA</LIST_TYPE>
    <REFERENCE_NUMBER>111</REFERENCE_NUMBER>
    <LISTED_ON>2015-03-27-04:00</LISTED_ON>
    <COMMENTS1>Just some guy</COMMENTS1>
    <LIST_TYPE>
        <VALUE>List One</VALUE>
    </LIST_TYPE>
    <LAST_DAY_UPDATED>
        <VALUE/>
    </LAST_DAY_UPDATED>
    <NICKNAME>
        <QUALITY/>
        <VALUE/>
    </NICKNAME>
    <ADDRESS>
        <CITY>nyc</CITY>
        <STATE_PROVINCE>ny</STATE_PROVINCE>
        <COUNTRY>usa</COUNTRY>
    </ADDRESS>
    <DOB>
        <TYPE_OF_DATE>EXACT</TYPE_OF_DATE>
        <YEAR>1901</YEAR>
    </DOB>
    <POB>
        <COUNTRY>London</COUNTRY>
    </POB>
</INDIVIDUAL>
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 4, 2018, 4:39pm UTC](https://discuss.elastic.co/t/xml-to-elasticsearch-via-logstash/120726/47 "2018-03-04T16:39:51Z")

</div>

No! Come on! I asked for `stdout { codec => rubydebug }` output. Last chance now before I give up.

---

<div class="post-metadata">

**Author:** ![Errors](https://avatars.discourse-cdn.com/v4/letter/e/a9adbd/32.png) [@Errors](https://discuss.elastic.co/u/Errors)\
**Post date:** [March 6, 2018, 7:40pm UTC](https://discuss.elastic.co/t/xml-to-elasticsearch-via-logstash/120726/48 "2018-03-06T19:40:52Z")

</div>

I'm not quite sure what you mean by that, could you give me an example? I thought what I provided in post 39 was the output?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2018, 7:41pm UTC](https://discuss.elastic.co/t/xml-to-elasticsearch-via-logstash/120726/49 "2018-04-03T19:41:03Z")

</div>

Closed on April 3, 2018, 7:41pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/xml-to-elasticsearch-via-logstash/120726.md?page=2)