# Xpath filtering

**URL:** <https://discuss.elastic.co/t/xpath-filtering/173574>\
**Category:** Logstash\
**Created:** [March 23, 2019, 1:54am UTC](https://discuss.elastic.co/t/xpath-filtering/173574 "2019-03-23T01:54:04Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![sverma](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@sverma](https://discuss.elastic.co/u/sverma)\
**Post date:** [March 23, 2019, 1:54am UTC](https://discuss.elastic.co/t/xpath-filtering/173574/1 "2019-03-23T01:54:04Z")

</div>

I am parsing an xml file via logstash and in my xml structure I have few repeated tags as below :  
\<.....\>  
\<.......\>  
\<hard\_request name="mem\_avail" resource\_contribution="0.000000"\>900G\</hard\_request\>  
\<hard\_request name="h\_rt" resource\_contribution="0.000000"\>518400\</hard\_request\>  
\<......\>  
\<.....\>  
For this I need the output as :  
"hard\_request" =\> [  
[0] mem\_avail = 900G  
[1] h\_rt = 518400  
]

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 23, 2019, 1:07pm UTC](https://discuss.elastic.co/t/xpath-filtering/173574/2 "2019-03-23T13:07:53Z")

</div>

```
    xml { source => "message" target => "[@metadata][theXML]" }
    ruby {
        code => '
            a = []
            event.get("[@metadata][theXML][hard_request]").each { |x|
                a << { x["name"] => x["content"] }
            }
            event.set("hard_request", a)
        '
    }

```

will get you

```
"hard_request" => [
    [0] {
        "mem_avail" => "900G"
    },
    [1] {
        "h_rt" => "518400"
    }
],
```

---

<div class="post-metadata">

**Author:** ![sverma](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@sverma](https://discuss.elastic.co/u/sverma)\
**Post date:** [March 24, 2019, 4:41am UTC](https://discuss.elastic.co/t/xpath-filtering/173574/3 "2019-03-24T04:41:54Z")

</div>

Thanks ! this works perfect.  
What if I further want to store the "hard\_request" in below format:  
"hard\_request" =\> mem\_avail:900G, h\_rt: 518400,......

I tried with "join" :  
mutate { join =\> { "hard\_request" =\> "," } }  
but achieved below result:  
"hard\_request" =\> "{"mem\_avail"=\>"900G"},{"h\_rt"=\>"518400"}",

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 24, 2019, 11:43am UTC](https://discuss.elastic.co/t/xpath-filtering/173574/4 "2019-03-24T11:43:41Z")

</div>

> [@sverma](#):
>
> "hard\_request" =\> mem\_avail:900G, h\_rt: 518400,......

I do not know what you mean by this. Is it an array of strings, with the first string being "mem\_avail:900G"?

---

<div class="post-metadata">

**Author:** ![sverma](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@sverma](https://discuss.elastic.co/u/sverma)\
**Post date:** [March 25, 2019, 11:19am UTC](https://discuss.elastic.co/t/xpath-filtering/173574/5 "2019-03-25T11:19:42Z")

</div>

Yes. basically I meant array elements concatenated into string with say "," separator.  
First string can be anything depending upon what is at 0th index and "hard\_request" tags could be 'n' number thus number of array elements can also vary in each event.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 25, 2019, 2:24pm UTC](https://discuss.elastic.co/t/xpath-filtering/173574/6 "2019-03-25T14:24:09Z")

</div>

I am still not entirely clear what you want, but

```
    ruby {
        code => '
            s = ""
            event.get("[@metadata][theXML][hard_request]").each { |x|
                s = s + x["name"] +":" + x["content"] + ","
            }
            event.set("hard_request", s.chomp(","))
        '
    }

```

will get you

```
"hard_request" => "mem_avail:900G,h_rt:518400",
```

---

<div class="post-metadata">

**Author:** ![sverma](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@sverma](https://discuss.elastic.co/u/sverma)\
**Post date:** [March 27, 2019, 1:00am UTC](https://discuss.elastic.co/t/xpath-filtering/173574/7 "2019-03-27T01:00:45Z")

</div>

You nailed it ! This is exactly what I meant.  
Thank you !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2019, 1:00am UTC](https://discuss.elastic.co/t/xpath-filtering/173574/8 "2019-04-24T01:00:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.