# How to access XML data and use GROK filter on it?

**URL:** https://discuss.elastic.co/t/how-to-access-xml-data-and-use-grok-filter-on-it/154512
**Category:** Logstash
**Created:** [October 29, 2018, 8:43pm UTC](https://discuss.elastic.co/t/how-to-access-xml-data-and-use-grok-filter-on-it/154512 "2018-10-29T20:43:31Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Samvid\_Kulkarni](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Samvid\_Kulkarni](https://discuss.elastic.co/u/Samvid_Kulkarni)
#### Post date: [October 29, 2018, 8:43pm UTC](https://discuss.elastic.co/t/how-to-access-xml-data-and-use-grok-filter-on-it/154512/1 "2018-10-29T20:43:31Z")

</div>

I am trying to parse Microsoft Active Directory which is completely in XML format. Below is the example of the logs. [Here is link to log](https://pastebin.com/xwSUZSur)

Below is my config file

```
filter {
grok 
   {
      match => ["message", "%{TIMESTAMP_ISO8601:syslog_ts}?\|\|%{NONNEGINT:syslog_cat}\|\|%{NONNEGINT:syslog_severity}\|\|%{IP:syslog_src}?\|\|%{DATA:info}:%{SPACE}%{GREEDYDATA:XML_Message}"]

      match => ["message", "^%{TIMESTAMP_ISO8601:syslog_ts}?\|\|%{NONNEGINT:syslog_cat}\|\|%{NONNEGINT:syslog_severity}\|\|%{IP:syslog_src}?\|\|%{DATA:info}:%{SPACE}%{GREEDYDATA:XML_Message}"]

      match => ["message", "^%{TIMESTAMP_ISO8601:syslog_ts}?\|\|%{NONNEGINT:syslog_cat}\|\|%{NONNEGINT:syslog_severity}\|\|%{IP:syslog_src}?\|\|%{DATA:info}:%{SPACE}%{GREEDYDATA:XML_Message}"]

   }
    xml 
    {
    source => "XML_Message"
    target => "parsed_xml"
    force_array => false
    suppress_empty => false
  }

 # NEED TO EXRACT DATA FROM EVENTDATA

  if [parsed_xml][EventData] == 5156
  {
  grok
  {
      match => ["[parsed_xml][EventData]", "^(?<Message2>([^#]*))Application Information:Process ID:%{DATA:process_id}Application Name:%{DATA:application_name}Network Information:Direction:%{USERNAME:direction}Source Address:%{IP:source_adddress}Source Port:%{NUMBER:source_port}Destination Address:%{IP:destination_ip}Destination Port:%{NUMBER:destination_port}Protocol:%{USERNAME:protocol}Filter Information:Filter Run-Time ID:%{USERNAME:filter_run_time_id}Layer Name:%{DATA:layer_name}Layer Run-Time ID:%{NUMBER:layer_run_time_id}" ]
  }
  }
}

```

The issue I am having is that I need to parse fields from `<EventData>` as well but I am not able to access it. i am not getting any fields in kibana and there is no`_grokparsefailure` as well.

i am using IF loop to access fields based on event id but nothing is getting extracted.

So how do I access XML fields and further process it using GROK?

---

<div class="post-metadata">

### Author: ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [October 30, 2018, 3:00pm UTC](https://discuss.elastic.co/t/how-to-access-xml-data-and-use-grok-filter-on-it/154512/2 "2018-10-30T15:00:47Z")

</div>

Why not use the winlogbeat agent to collect the data and then the beats input? You can configure the winlogbeat agent to only collect certain events if so desired and the two together properly parse the data without having to configure grok patterns.

---

<div class="post-metadata">

### Author: ![Samvid\_Kulkarni](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Samvid\_Kulkarni](https://discuss.elastic.co/u/Samvid_Kulkarni)
#### Post date: [November 5, 2018, 5:14pm UTC](https://discuss.elastic.co/t/how-to-access-xml-data-and-use-grok-filter-on-it/154512/3 "2018-11-05T17:14:11Z")

</div>

thanks and sorry for late reply. i will look into winlogbeat.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 3, 2018, 5:14pm UTC](https://discuss.elastic.co/t/how-to-access-xml-data-and-use-grok-filter-on-it/154512/4 "2018-12-03T17:14:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.