# Extracting multiline xml fields from a log

**URL:** <https://discuss.elastic.co/t/extracting-multiline-xml-fields-from-a-log/214954>\
**Category:** Logstash\
**Created:** [January 14, 2020, 8:53am UTC](https://discuss.elastic.co/t/extracting-multiline-xml-fields-from-a-log/214954 "2020-01-14T08:53:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![angelcab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/angelcab/32/45618_2.png) [@angelcab](https://discuss.elastic.co/u/angelcab)\
**Post date:** [January 14, 2020, 8:53am UTC](https://discuss.elastic.co/t/extracting-multiline-xml-fields-from-a-log/214954/1 "2020-01-14T08:53:58Z")

</div>

Hello

I'm struggling with a problem trying to extract indepent fields from a log which contains a XML embebbed.  
I'm using logstash for the ingesting into elasticsearch. First, I collect the logs with filebeat and send it to kafka (architecture reasons). So, logstash conf file is read from kafka and ingest into elastic.

The format of my message is similar to this:

```
2019-12-06 14:34:13,620 hostname: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/13514][connectionId=C328C3D8]] INFO - >>message: { some data in JSON}
<?xml version="1.0" encoding="UTF-8"?>
<Document xmlns="urn:iso:std:iso:20022"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="urn:iso:std:iso:20022">
   <FIToFICstmrCdtTrf>
      <GrpHdr>
         <MsgId>Fe9275f33b63794dea4</MsgId>
....some other fields...
</Document>

2019-12-06 14:34:13,620 hostname:*** another log line

```

So, the idea is to ingest the log into elasticsearch but extract every single node in xml in sepparated fields.

I've tryed with a grok filter to identified the message (this specific structure) and then parse with the xml filter but I haven't succeeded. One of the problems is that I've lines in the logs that are not equal as the showed, there are also lines without the xml.. so I've only had to match this concret log line with the xml inside.

Any adviced or help?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 14, 2020, 2:34pm UTC](https://discuss.elastic.co/t/extracting-multiline-xml-fields-from-a-log/214954/2 "2020-01-14T14:34:40Z")

</div>

> [@angelcab](#):
>
> Any adviced or help?

Assuming you are using multiline to combine everything between the two dates with the preceding date you can use an xml filter. It will ignore all the noise preceding the \<?xml provide you use 'store\_xml =\> true' and not xpath.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 11, 2020, 2:34pm UTC](https://discuss.elastic.co/t/extracting-multiline-xml-fields-from-a-log/214954/3 "2020-02-11T14:34:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.