# Console XML works, but not file XML
**URL:** https://discuss.elastic.co/t/console-xml-works-but-not-file-xml/206645
**Category:** Logstash
**Created:** [November 5, 2019, 4:36pm UTC](https://discuss.elastic.co/t/console-xml-works-but-not-file-xml/206645 "2019-11-05T16:36:17Z")
**Posts on this page:** 1
**Showing post:** 5
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 5, 2019, 9:24pm UTC](https://discuss.elastic.co/t/console-xml-works-but-not-file-xml/206645/5 "2019-11-05T21:24:28Z")
The problem is your multiline codec. It is not combining lines into valid XML. The first messages are
```
\n...false
\n...false
```
When using target the xml filter will actually parse the first one, but the xpath option is completely unforgiving of any junk around the XML.
Change your codec to use
```
pattern => " true
what => "previous"
```
Then you need some filters to clean up the results
```
if [message] =~ /<\?xml/ { drop {} }
mutate { gsub => ["message", "<(/)?Requests>", ""] }
```
That leaves you with valid XML. You have some typos in your xpath expressions you will need to clean.
I actually would not do it using xpath. I don't like that everything is an array. Instead I would use
```
target => "xml_value"
store_xml => true
force_array => false
```
Now I realize you want to everything to have different names, but to get the names you want you basically add an underscore before an uppercase letter (except at start of key name) then fold to lowercase. That is easy enough to do in ruby...
```
ruby {
code => '
x = event.get("xml_value")
if x
x.each { |k, v|
newk = k.gsub(/(?!^)([A-Z])/, "_\\1")
newk = newk.downcase
event.remove("[xml_value][#{k}]")
event.set("[xml_value][#{newk}]", v)
}
end
'
}
```
If you are new to Ruby regexps, (?!^) is a negative lookahead assertion which means do not match when ^ is at the start of the pattern. So this pattern only matches inside a key value, not at its start.
---
_[View the full topic](https://discuss.elastic.co/t/console-xml-works-but-not-file-xml/206645)._