XPath on Message Context Search Field Expression Plugin
The XPath on Message Context plugin runs an XPath 1.0 expression on XML stored in one context property of a Log Event, not on the message body. Use it when a system puts an XML document, such as an order summary, into a context property.
- ✅ Reads one named context property; the message body is ignored
- ✅ Same XPath rules as the XPath plugin, including element names without namespace prefixes
When to use it
| Your data | Use |
|---|---|
| Plain XML in the message body; you want element or attribute values as they are | XPath |
| Only part of an XML value (a file name in a path, an ID in a formatted string), or tag names inside an XML sub-tree | XPath with RegEx |
| XML stored as escaped text inside an element of another XML message | XPath on Wrapped XPath |
| XML stored in a context property instead of the body | XPath on Message Context (this page) |
| XPath 2.0, or XPath combined with other functions (decode Base64 first, concatenate, compare) | Formula with xPath2 |
When the context value isn't XML, use Message Context Key for the whole value or RegEx on Message Context for part of it; for the other plugins, see Choose a plugin.
Expression syntax
names the property"] --> B["XML value of
that property"] B --> C["XPath
selects values"] C --> D["fa:fa-magnifying-glass-plus Unique values"] style A fill:#2678BD,color:#fff style B fill:#3F827B,color:#fff style C fill:#E47528,color:#fff style D fill:#93d16d,color:#000
The Context key (blue) picks the property; its XML value (teal) is read with the XPath (orange); the matches become the Search Field values (green).
The plugin shows these fields:
| Field | What goes in it |
|---|---|
| XPath | The XPath 1.0 expression to use on the context value, written from the root without a leading / (Orders/Order/Id). Element names match without namespace prefixes; the supported syntax is listed in Allowed XPath expressions. |
| Context key | The name of the context property that holds the XML. The name is case sensitive. |
Duplicates are collapsed into unique values (How expressions run). Pick the plugin in the Expression Type list when you add or manage a Search Field. To test it, add the key and its XML value on the Message Context tab of the Test Expression tab (Test Your Expression).
Selecting XPath on Message Context in the Expression Type list.
Examples
Example 1: Get the order IDs from an XML context property
Input
| Context key | Value |
|---|---|
XMLContent |
<ns0:Orders xmlns:ns0="Common.Schemas/Nodinite/1.0"><Order><Id>101</Id></Order><Order><Id>102</Id></Order></ns0:Orders> |
Expression
| Field | Value |
|---|---|
| XPath | Orders/Order/Id |
| Context key | XMLContent |
Result
101
102
XPath Orders/Order/Id on the XMLContent context key returns 2 unique matches; the Message Context tab holds the test value.
Limitations
- The Context key must match the property name exactly, including case. If the property is missing or its value isn't XML, the expression returns no value.
- Context properties and the reserved keys are described in Context Options. Properties that the ContextPropertiesFilters System Parameter removes aren't kept, so don't base a Search Field on them.
- The XPath uses the same forward-only reader as the XPath plugin, so only the syntax in Allowed XPath expressions works.
An expression that matches nothing gives this result in the test:
No match: the test reports a warning instead of values.