# Decode\_xml not working **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [April 10, 2021, 7:03am UTC](https://discuss.elastic.co/t/decode-xml-not-working/269763 "2021-04-10T07:03:50Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![witkacy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/witkacy/32/86869_2.png) [@witkacy](https://discuss.elastic.co/u/witkacy)\ **Post date:** [April 10, 2021, 7:03am UTC](https://discuss.elastic.co/t/decode-xml-not-working/269763/1 "2021-04-10T07:03:50Z")
Hello, I'm using winlogbeats version 7.12 and it works great but I have a question. In my windows log in message field I have an XML. What I would like to do is first check if in that XML in specific field there is a specified text and if yes then only store a subset of those XML fields. What I do right now is that I'm using processor _drop\_event_ with condition: when -\> not -\> contains -\> message: myStringToSearchFor And then I have a processor _script_ sth like: ```auto function process(event) { var re = /\w+<\/ResponseStatus>/; var str = event.Get("message"); var myMatch = str.match(re); if(myMatch){ event.Put("status", myMatch[0]); } event.Delete("message"); } ``` It is only an example with only one field (ResponseStatus) from my xml message extracted, in the future I would like to extract like 5-10 fields from it. Still this code works quite well, but I'm not fully convinced that it will perform super fast. I found decode\_xml processor but when I put there configuration from documentation it didn't work with informatiion: parameter fields is missing. ```auto - decode_xml: fields: message target_field: xml ignore_missing: true ignore_failure: true ``` So question is: do I use decode\_xml in an inccorect way? If it would work would it be faster? ---
**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\ **Post date:** [April 13, 2021, 11:10pm UTC](https://discuss.elastic.co/t/decode-xml-not-working/269763/2 "2021-04-13T23:10:48Z")
Using the processor would surely be more performant, especially if you planned on using regex. Usually I tend to just format the whole message into something that is easier to transform, delete or modify, so if we could get the decode\_xml processor to decode the message first it would surely be easier to manage afterwards. I think what you want to use is `field` and not `fields`, for example: ``` - decode_xml: field: message target_field: xml ignore_missing: true ignore_failure: true ``` Also make sure the indentation is correct, and that should resolve it. Hopefully that fixes it 🙂 ---
**Author:** ![witkacy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/witkacy/32/86869_2.png) [@witkacy](https://discuss.elastic.co/u/witkacy)\ **Post date:** [April 14, 2021, 6:18am UTC](https://discuss.elastic.co/t/decode-xml-not-working/269763/3 "2021-04-14T06:18:44Z")
Hello @Marius_Iversen I tried it end then I get message: ```auto Exiting: Failed to create new event log. missing fields option in winlogbeat.event_logs.0.processors.2.decode_xml ``` ---
**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\ **Post date:** [April 14, 2021, 10:10am UTC](https://discuss.elastic.co/t/decode-xml-not-working/269763/4 "2021-04-14T10:10:21Z")
Could you post a copy of the whole input + the decode\_xml processor? There seems to be an issue then with indentation or similar. ---
**Author:** ![witkacy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/witkacy/32/86869_2.png) [@witkacy](https://discuss.elastic.co/u/witkacy)\ **Post date:** [April 14, 2021, 11:10am UTC](https://discuss.elastic.co/t/decode-xml-not-working/269763/5 "2021-04-14T11:10:04Z")
Hello @Marius_Iversen Sure, this is taht file, if I remove decode\_xml processor segment then it works so it has to be a probem with decode\_xml processor. ```auto winlogbeat.event_logs: - name: test ignore_older: 1h processors: - drop_fields: fields: ["host", "log", "event", "winlog"] - drop_event: when: not: contains: message: StatusCode=200 OK - decode_xml: field: message target_field: xml ignore_missing: true ignore_failure: true setup.template.settings: setup.kibana: output.file: path: "C:/tmp/test_log_new" filename: winlogbeat rotate_every_kb: 10000 number_of_files: 1000 ``` ---
**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\ **Post date:** [April 26, 2021, 4:04pm UTC](https://discuss.elastic.co/t/decode-xml-not-working/269763/6 "2021-04-26T16:04:38Z")
Hello @witkacy , seems like this was indeed a bug from our side, and this is being resolved in 7.13 and 7.12.2, unfortunately you will have to wait just a little bit longer, sorry for the inconvenience! ☹ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 24, 2021, 6:05pm UTC](https://discuss.elastic.co/t/decode-xml-not-working/269763/7 "2021-05-24T18:05:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.