# Xpath fails to extract

**URL:** <https://discuss.elastic.co/t/xpath-fails-to-extract/320479>\
**Category:** Logstash\
**Created:** [December 5, 2022, 3:23pm UTC](https://discuss.elastic.co/t/xpath-fails-to-extract/320479 "2022-12-05T15:23:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefanocog](https://avatars.discourse-cdn.com/v4/letter/s/5fc32e/32.png) [@stefanocog](https://discuss.elastic.co/u/stefanocog)\
**Post date:** [December 5, 2022, 3:23pm UTC](https://discuss.elastic.co/t/xpath-fails-to-extract/320479/1 "2022-12-05T15:23:14Z")

</div>

Hi, i need extract one value from a parsed XML, my logstash configuration is

```auto
xml {
    source => "contentRequest"
    target => "contentRequest_field"
    store_xml => false
    xpath => ["/datianagrafici/datipersonali/codicefiscale", "codicefiscale"]
  }

```

If i set `store_xml => true` i see this extracted filelds

![2022-12-05_16-12](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9d7a4e5fde311b61f0276a7dfbd36cdedae72df.png)

I need extract the value of `codicefiscale`, based on this view i set `xpath` configuration in this way

```auto
xpath => ["/datianagrafici/datipersonali/codicefiscale", "codicefiscale"]

```

I also tried to set

```auto
xpath => ["//datianagrafici/datipersonali/codicefiscale", "codicefiscale"]

```

but I've same result. I'm expectd a new field into elasticsearch called `codicefiscale`, but I don't see it, is correct?

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 5, 2022, 5:37pm UTC](https://discuss.elastic.co/t/xpath-fails-to-extract/320479/2 "2022-12-05T17:37:51Z")

</div>

What does the source XML look like?

---

<div class="post-metadata">

**Author:** ![stefanocog](https://avatars.discourse-cdn.com/v4/letter/s/5fc32e/32.png) [@stefanocog](https://discuss.elastic.co/u/stefanocog)\
**Post date:** [December 5, 2022, 6:01pm UTC](https://discuss.elastic.co/t/xpath-fails-to-extract/320479/3 "2022-12-05T18:01:55Z")

</div>

Unfortunately the XML is incorrectly formatted, but logstash xml plugin extract correctly all fields, I don't know if this is a problem for xpath, `contentRequest` is exactly:

```auto
{ "xml": "<lavoratore><datiinvio><dataultimoagg>2019-05-22</dataultimoagg><codiceentetit>xxxxxxx</codiceentetit><tipovariazione>01</tipovariazione><datadinascita>1985-08-23</datadinascita></datiinvio><datianagrafici><datipersonali><codicefiscale>xxxxxxxxxx</codicefiscale><cognome>xxxxxx</cognome><nome>xxxxxxxxx</nome><sesso>x</sesso><datanascita>1985-08-23</datanascita><codcomune>xxxx</codcomune><codcittadinanza>xxx</codcittadinanza></datipersonali><residenza><codcomune>xxxx</codcomune><cap>xxxx</cap><indirizzo>xxxxxxx</indirizzo><localita /></residenza><domicilio><codcomune>xxx</codcomune><cap>xxxxx</cap><indirizzo>xxxxxxxx</indirizzo></domicilio><recapiti><telefono>0000000000</telefono><cellulare>3xxxxxxx</cellulare></recapiti></datianagrafici></lavoratore>"}

```

Indented version:

```auto
<lavoratore>
   <datiinvio>
      <dataultimoagg>xxxx-xx-xx</dataultimoagg>
      <codiceentetit>xxxxxxx</codiceentetit>
      <tipovariazione>xx</tipovariazione>
      <datadinascita>xxxx-xx-xx</datadinascita>
   </datiinvio>
   <datianagrafici>
      <datipersonali>
         <codicefiscale>xxxxxxxxxx</codicefiscale>
         <cognome>xxxxxx</cognome>
         <nome>xxxxxxxxx</nome>
         <sesso>x</sesso>
         <datanascita>xxxx-xx-xx</datanascita>
         <codcomune>xxxx</codcomune>
         <codcittadinanza>xxx</codcittadinanza>
      </datipersonali>
      <residenza>
         <codcomune>xxxx</codcomune>
         <cap>xxxx</cap>
         <indirizzo>xxxxxxx</indirizzo>
         <localita />
      </residenza>
      <domicilio>
         <codcomune>xxx</codcomune>
         <cap>xxxxx</cap>
         <indirizzo>xxxxxxxx</indirizzo>
      </domicilio>
      <recapiti>
         <telefono>0000000000</telefono>
         <cellulare>xxxxxxx</cellulare>
      </recapiti>
   </datianagrafici>
</lavoratore>

```

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 5, 2022, 6:55pm UTC](https://discuss.elastic.co/t/xpath-fails-to-extract/320479/4 "2022-12-05T18:55:51Z")

</div>

The parsing used for store\_xml is fundamentally different to the parsing used for xpath. The former [uses](https://github.com/logstash-plugins/logstash-filter-xml/blob/e947ec5b08e8b25ee35aba1bb0bcd070b1454dae/lib/logstash/filters/xml.rb#L195) the xml-simple library, the latter [uses](https://github.com/logstash-plugins/logstash-filter-xml/blob/e947ec5b08e8b25ee35aba1bb0bcd070b1454dae/lib/logstash/filters/xml.rb#L152) Nokogiri.

Nokogiri only works on correctly formatted XML. XmlSimple tolerates all kinds of leading or trailing junk around the XML.

Try

```
    json { source => "contentRequest" target => "[@metadata][contentRequest]" }
    xml {
        source => "[@metadata][contentRequest][xml]"
        store_xml => false
        xpath => { "//datianagrafici/datipersonali/codicefiscale/text()" => "codicefiscale" }
    }

```

---

<div class="post-metadata">

**Author:** ![stefanocog](https://avatars.discourse-cdn.com/v4/letter/s/5fc32e/32.png) [@stefanocog](https://discuss.elastic.co/u/stefanocog)\
**Post date:** [December 5, 2022, 8:36pm UTC](https://discuss.elastic.co/t/xpath-fails-to-extract/320479/5 "2022-12-05T20:36:49Z")

</div>

> [@Badger](#):
>
> ```auto
> source => "[@metadata][contentRequest][xml]"
> store_xml => false
> xpath => { "//datianagrafici/datipersonali/codicefiscale/text()" => "codicefiscale" }
> 
> ```

You saved me! So it's like I thought, xpath thinks differently

 ![2022-12-05_21-35](https://us1.discourse-cdn.com/elastic/original/3X/4/3/4347c72c256bb553e7b317c6aa2aa6f1589a002d.png)

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2023, 8:37pm UTC](https://discuss.elastic.co/t/xpath-fails-to-extract/320479/6 "2023-01-02T20:37:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.