# DMARC XML FIle

**URL:** <https://discuss.elastic.co/t/dmarc-xml-file/214248>\
**Category:** Logstash\
**Created:** [January 8, 2020, 2:31pm UTC](https://discuss.elastic.co/t/dmarc-xml-file/214248 "2020-01-08T14:31:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wilks](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Wilks](https://discuss.elastic.co/u/Wilks)\
**Post date:** [January 8, 2020, 2:31pm UTC](https://discuss.elastic.co/t/dmarc-xml-file/214248/1 "2020-01-08T14:31:50Z")

</div>

Hi All,  
I am trying to send dmarc logs to elasticsearch and running into some issues with the logstash config. Logstash only appears to process the first few lines of the xml log file as per below.

 ![Screen Shot 2020-01-08 at 9.29.07 AM](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f33c1f7a3eb2b47b2d2c01145f73c41af7d7c700.png)

It seems to be something with the pattern =\> "^\<?feedback.\*\>" but I could be wrong. Below is the Logstash config

input {  
file {  
path =\> "/var/cache/dmarc-reports/\*.xml"  
start\_position =\> "beginning"  
discover\_interval =\> "1"  
tags =\> ["dmarc-reports"]  
codec =\> multiline {  
pattern =\> "^\<?feedback\>"  
negate =\> true  
what =\> "previous"  
}  
}  
}  
filter {  
xml {  
#store\_xml =\> "false"  
target =\> "dmarc"  
source =\> "message"  
}  
}  
output {  
elasticsearch {  
hosts =\> ["10.10.10.34:9200"]  
http\_compression =\> "true"  
index =\> "dmarc-%{+YYYY.MM.dd}"  
}  
stdout { codec =\> rubydebug }

---

<div class="post-metadata">

**Author:** ![Wilks](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Wilks](https://discuss.elastic.co/u/Wilks)\
**Post date:** [January 8, 2020, 2:35pm UTC](https://discuss.elastic.co/t/dmarc-xml-file/214248/2 "2020-01-08T14:35:05Z")

</div>

The XML is the following:

 ![Screen Shot 2020-01-08 at 9.35.43 AM](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f3027d5d3a563d6d9801ad88210089d9e261e9fb.png)

---

<div class="post-metadata">

**Author:** ![Wilks](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Wilks](https://discuss.elastic.co/u/Wilks)\
**Post date:** [January 8, 2020, 5:09pm UTC](https://discuss.elastic.co/t/dmarc-xml-file/214248/3 "2020-01-08T17:09:33Z")

</div>

Nevermind Figured it out  
😄

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2020, 5:09pm UTC](https://discuss.elastic.co/t/dmarc-xml-file/214248/4 "2020-02-05T17:09:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.