# Filtering json with embedded xml

**URL:** https://discuss.elastic.co/t/filtering-json-with-embedded-xml/138955
**Category:** Logstash
**Created:** [July 6, 2018, 4:36pm UTC](https://discuss.elastic.co/t/filtering-json-with-embedded-xml/138955 "2018-07-06T16:36:25Z")
**Posts on this page:** 1
**Showing post:** 6

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 6, 2018, 5:32pm UTC](https://discuss.elastic.co/t/filtering-json-with-embedded-xml/138955/6 "2018-07-06T17:32:42Z")

</div>

```
    # Capture the JSON after payload, then remove it
    grok { match => { "message" => '>",(?<endOfJson>[^>]+)$' } }
    mutate { gsub => ["message", ">[^>]+$", "" ] }

    # Split the remainder into the initial JSON and the payload
    dissect { mapping => { "message" => '%{startOfJson}"payload":"%{payload}' } }

    # Fix up the XML. I am mystified where that >> comes from, but get rid of it!
    mutate { gsub => ["payload", "&lt;", "<", "payload", "$", ">" , "payload", ">>", ">"] }

    # Parse the XML
    xml { source => "payload" store_xml => true target => "theXML" force_array => false }

    # Create some valid json and parse it. Use target in json filter?
    mutate { add_field => { "wholeJson" => "%{startOfJson}%{endOfJson}" } }
    json { source => "wholeJson" }

    #mutate { remove_field => ["startOfJson", "endOfJson", "wholeJson", "payload"] }

```

And if you do not like the format of DynamicHeaders then you can change it using [this](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481/12?u=badger).

---

_[View the full topic](https://discuss.elastic.co/t/filtering-json-with-embedded-xml/138955)._