# Xpath throws ClassCastException for one particular XML node

**URL:** <https://discuss.elastic.co/t/xpath-throws-classcastexception-for-one-particular-xml-node/226038>\
**Category:** Logstash\
**Created:** [April 1, 2020, 11:48am UTC](https://discuss.elastic.co/t/xpath-throws-classcastexception-for-one-particular-xml-node/226038 "2020-04-01T11:48:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paul\_Offord](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_offord/32/65261_2.png) [@Paul\_Offord](https://discuss.elastic.co/u/Paul_Offord)\
**Post date:** [April 1, 2020, 11:48am UTC](https://discuss.elastic.co/t/xpath-throws-classcastexception-for-one-particular-xml-node/226038/1 "2020-04-01T11:48:47Z")

</div>

Hi,

I am using the XML filter to ingest a file that looks like this:

```auto
<Events>
... other events
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
	<System>
		<Provider Name="Microsoft-Windows-WinINet" Guid="{43d1a55c-76d6-4f7e-995c-64c711e5cafe}" />
		<EventID>108</EventID>
		<Version>0</Version>
		<Level>4</Level>
		<Task>503</Task>
		<Opcode>0</Opcode>
		<Keywords>0x8000000000000001</Keywords>
		<TimeCreated SystemTime="2020-03-27T14:08:47.392601500+00:00" />
		<Correlation ActivityID="{00cc000c-12e5-0000-dc12-fc05e043051f}" />
		<Execution ProcessID="4828" ThreadID="1532" ProcessorID="0" KernelTime="24105" UserTime="18705" />
		<Channel>Microsoft-Windows-WinINet/Analytic</Channel>
		<Computer />
	</System>
	<EventData>
		<Data Name="ConnectionHandle">0xCC000C</Data>
		<Data Name="_ServerNameLength">17</Data>
		<Data Name="ServerName">xxxyyyyy.zzzz.com</Data>
		<Data Name="ServerPort"> 15148</Data>
		<Data Name="_ServiceLength">4</Data>
		<Data Name="Service">http</Data>
	</EventData>
	<RenderingInfo Culture="en-GB">
		<Level>Information </Level>
		<Opcode>Info </Opcode>
		<Keywords>
			<Keyword>Flagged on all WinINet events dealing with creation or destruction of INTERNET handles </Keyword>
		</Keywords>
		<Task>WININET_HTTP_REQUEST_HANDLE_CREATED </Task>
		<Message>Request handle 0xCC000C Server Details: Server=xxxyyyyy.zzzz.com Port=15148 Service=http </Message>
		<Channel>Microsoft-Windows-WinINet/Analytic</Channel>
		<Provider>Microsoft-Windows-WinINet </Provider>
	</RenderingInfo>
</Event>
... other events
</Events>

```

The filter section of my config file looks like this:

```auto
filter {
    xml {
	  remove_namespaces => true
      source => "message"
	  target => "wininet"
	  store_xml => true
	  force_array => false
      xpath => ["//Event/System/TimeCreated/@SystemTime", "SystemTime"]
      xpath => ["//Event/System/EventID/text()", "EventID"]
      xpath => ["//Event/System/Task/text()", "Task"]
      xpath => ["//Event/System/Opcode/text()", "Opcode"]
      xpath => ["//Event/System/Execution/@ProcessID", "ProcessID"]
      xpath => ["//Event/System/Execution/@ThreadID", "ThreadID"]
      xpath => ["//Event/System/Execution/@UserTime", "UserTime"]
      xpath => ["//Event/System/Execution/@KernelTime", "KernelTime"]
      xpath => ["//Event/EventData/Data[@Name='URL']/text()", "URL" ]
      xpath => ["//Event/EventData/Data[@Name='ServerName']/text()", "ServerName" ]
      xpath => ["//Event/EventData/Data[@Name='ConnectionHandle']/text()", "ConnectionHandle" ]
      xpath => ["//Event/EventData/Data[@Name='Status']/text()", "Status" ]
      xpath => ["//Event/EventData/Data[@Name='Verb']/text()", "Verb" ]
      xpath => ["//Event/EventData/Data[@Name='RequestHeader']/text()", "RequestHeader" ]
      xpath => ["//Event/EventData/Data[@Name='ResponseHeader']/text()", "ResponseHeader" ]
      xpath => ["//Event/EventData/Data[@Name='ResponseCode']/text()", "ResponseCode" ]
      xpath => ["//Event/EventData/Data[@Name='Error']/text()", "Error" ]
      xpath => ["//Event/EventData/Data[@Name='ConnectionHandle']/text()", "ConnectionHandle" ]
      xpath => ["//Event/RenderingInfo/Task/text()", "Task"]
      xpath => ["//Event/RenderingInfo/Message/text()", "Message"]
    }
}

```

When I run Logstash, I get:

```auto
An unexpected error occurred! {:error=>java.lang.IllegalStateException: java.lang.ClassCastException: Cannot cast org.jruby.specialized.RubyArrayTwoObject to org.jruby.RubyString

```

If I comment out the configuration line referring to `ConnectionHandle` everything works OK, including the ingestion of `ServerName`. The format of the `ConnectionHandle` and `ServerName` values in the XML look the same, and the xpath parameters look the same.

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![Paul\_Offord](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_offord/32/65261_2.png) [@Paul\_Offord](https://discuss.elastic.co/u/Paul_Offord)\
**Post date:** [April 1, 2020, 12:02pm UTC](https://discuss.elastic.co/t/xpath-throws-classcastexception-for-one-particular-xml-node/226038/2 "2020-04-01T12:02:42Z")

</div>

Sorry to waste everyone's time here. Just realised, I have the xpath for ConnectionHandle defined twice.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2020, 12:03pm UTC](https://discuss.elastic.co/t/xpath-throws-classcastexception-for-one-particular-xml-node/226038/3 "2020-04-29T12:03:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.