# XML to JSON and parsing the last one

**URL:** https://discuss.elastic.co/t/xml-to-json-and-parsing-the-last-one/146824
**Category:** Logstash
**Created:** [August 31, 2018, 7:53am UTC](https://discuss.elastic.co/t/xml-to-json-and-parsing-the-last-one/146824 "2018-08-31T07:53:06Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![JPelastic](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@JPelastic](https://discuss.elastic.co/u/JPelastic)
#### Post date: [August 31, 2018, 7:53am UTC](https://discuss.elastic.co/t/xml-to-json-and-parsing-the-last-one/146824/1 "2018-08-31T07:53:06Z")

</div>

If I am correct, after the xml filter the field invoice contains JSON.

```auto
xml {
		source => "documentout"
		target => "invoice"
	}

```

I did confirm this in the stdout

```auto
"invoice" => {
                         "DeliveryDate" => [
            [0] "2018-07-04"
        ],
                    "BuyersOrderNumber" => [
            [0] "1823934"
        ],
                        "InvoiceTotals" => [
            [0] {
                                 "TotalInvoiceAmount" => [
                    [0] "3500.84"
                ],
                                     "TotalVATAmount" => [
                    [0] "607.58"

```

No I wold like to use the value of "BuyersOrderNumber" out of the new JSON to look something up in an external database. The first question is, how do I query the newly gotten JSON for the value of that field?

---

<div class="post-metadata">

### Author: ![JPelastic](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@JPelastic](https://discuss.elastic.co/u/JPelastic)
#### Post date: [August 31, 2018, 8:53am UTC](https://discuss.elastic.co/t/xml-to-json-and-parsing-the-last-one/146824/2 "2018-08-31T08:53:38Z")

</div>

I have been trying to use xpath on the xml but that just doesn't give any result. Even the remove\_namespaces =\> true has no effect on the output JSon.

This is the debug-info concerning the xml filter. It doesn't even mention the missing actions:

```auto
[2018-08-31T10:50:02,544][DEBUG][logstash.config.source.local.configpathloader] Reading config file {:config_file=>"XXXXXXXXXXXXX.conf"}
[2018-08-31T10:50:02,550][DEBUG][logstash.agent] Converging pipelines state {:actions_count=>0}
[2018-08-31T10:50:02,661][DEBUG][logstash.filters.xml] Event after xml filter {:event=>#<LogStash::Event:0x51820632>}
[2018-08-31T10:50:02,661][DEBUG][logstash.filters.xml] Event after xml filter {:event=>#<LogStash::Event:0x328b2f33>}
[2018-08-31T10:50:02,663][DEBUG][logstash.filters.xml] Running xml filter {:event=>#<LogStash::Event:0x10d3ecdf>}
[2018-08-31T10:50:02,672][DEBUG][logstash.filters.mutate] filters/LogStash::Filters::Mutate: removing field {:field=>"documentsigned"}
[2018-08-31T10:50:02,673][DEBUG][logstash.filters.mutate] filters/LogStash::Filters::Mutate: removing field {:field=>"documentout"}
[2018-08-31T10:50:02,677][DEBUG][logstash.filters.xml] Event after xml filter {:event=>#<LogStash::Event:0x6980aa5e>}
[2018-08-31T10:50:02,677][DEBUG][logstash.filters.mutate] filters/LogStash::Filters::Mutate: removing field {:field=>"documentsigned"}
[2018-08-31T10:50:02,678][DEBUG][logstash.filters.mutate] filters/LogStash::Filters::Mutate: removing field {:field=>"documentout"}
[2018-08-31T10:50:02,679][DEBUG][logstash.pipeline] output received {"event"=>{"@version"=>"1", "invoice"=>{"xmlns:ic"=>"

```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 4, 2018, 6:48am UTC](https://discuss.elastic.co/t/xml-to-json-and-parsing-the-last-one/146824/3 "2018-09-04T06:48:52Z")

</div>

> If I am correct, after the xml filter the field invoice contains JSON.

No, JSON is a string representation of structured data. After the xml filter you have structured data, not its string representation.

> No I wold like to use the value of "BuyersOrderNumber" out of the new JSON to look something up in an external database. The first question is, how do I query the newly gotten JSON for the value of that field?

`[invoice][BuyersOrderNumber][0]`

---

<div class="post-metadata">

### Author: ![JPelastic](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@JPelastic](https://discuss.elastic.co/u/JPelastic)
#### Post date: [September 4, 2018, 8:40am UTC](https://discuss.elastic.co/t/xml-to-json-and-parsing-the-last-one/146824/4 "2018-09-04T08:40:54Z")

</div>

Thanks Magnus,

i got it working!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 2, 2018, 8:40am UTC](https://discuss.elastic.co/t/xml-to-json-and-parsing-the-last-one/146824/5 "2018-10-02T08:40:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.