# Difficulties to parse/filter on xml file

**URL:** <https://discuss.elastic.co/t/difficulties-to-parse-filter-on-xml-file/2649>\
**Category:** Logstash\
**Created:** [June 14, 2015, 3:45pm UTC](https://discuss.elastic.co/t/difficulties-to-parse-filter-on-xml-file/2649 "2015-06-14T15:45:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![juju](https://avatars.discourse-cdn.com/v4/letter/j/258eb7/32.png) [@juju](https://discuss.elastic.co/u/juju)\
**Post date:** [June 14, 2015, 3:45pm UTC](https://discuss.elastic.co/t/difficulties-to-parse-filter-on-xml-file/2649/1 "2015-06-14T15:45:13Z")

</div>

Hello,

I'm trying to parse a xml file (Export of Arbor Alerts. example here [http://pastebin.com/jpQWMbjz](http://pastebin.com/jpQWMbjz))  
but it currently fails. Either Most lines are going unparsed into kibana, either nothing get inserted in elasticsearch

```
Trouble parsing xml with XmlSimple {:source=>"message", :value=>"</peakflow>", :exception=>#<REXML::ParseException: #<REXML::ParseException: Missing end tag for '' (got "peakflow")

```

Line: 1  
Position: 11

As the source file is validate xmlint, I', thinking it's more the multiline rule which is not getting extract correctly (but it shouldn't matter on xml source...)

Manual call

```
cat /vagrant/example-logs/Arbor-Alerts.xml | /opt/logstash/bin/logstash -f /vagrant/confs/logstash/logstash.conf

```

You can find the vagrant box and the configuration I use here

> **[juju4/ELK](https://github.com/juju4/ELK)**
>
> ELK related stuff

  
Also tried with this ELK configuration to check if it was my setup  

> **[comperiosearch/vagrant-elk-box](https://github.com/comperiosearch/vagrant-elk-box)**
>
> vagrant-elk-box - Vagrant box to install elasticsearch, logstash and kibana

  
but same results

Any hints?

Thanks

---

<div class="post-metadata">

**Author:** ![Joshua\_Rich](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshua_rich/32/44953_2.png) [@Joshua\_Rich](https://discuss.elastic.co/u/Joshua_Rich)\
**Post date:** [June 15, 2015, 6:47am UTC](https://discuss.elastic.co/t/difficulties-to-parse-filter-on-xml-file/2649/2 "2015-06-15T06:47:41Z")

</div>

I believe the xml filter expects the XML to appear more stream-like and less human-readable if that makes sense 😄 What happens if you avoid your xmlint call and ensure the XML input does not have extra whitespace in it (including newlines)?

---

<div class="post-metadata">

**Author:** ![juju](https://avatars.discourse-cdn.com/v4/letter/j/258eb7/32.png) [@juju](https://discuss.elastic.co/u/juju)\
**Post date:** [June 18, 2015, 12:32am UTC](https://discuss.elastic.co/t/difficulties-to-parse-filter-on-xml-file/2649/3 "2015-06-18T00:32:45Z")

</div>

I tried "cleaning" file with

```
$ tidy -xml -q file1.xml | tr -d '\n' > file2.xml

```

the output is one line without indent or extra new line

I resubmit file with and without disabling multiline but got nothing import and no debug output either (with either output: debug or elasticsearch)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:37am UTC](https://discuss.elastic.co/t/difficulties-to-parse-filter-on-xml-file/2649/4 "2017-07-06T05:37:11Z")

</div>