# How to combine multiple XML elements?

**URL:** <https://discuss.elastic.co/t/how-to-combine-multiple-xml-elements/153351>\
**Category:** Logstash\
**Created:** [October 22, 2018, 8:57am UTC](https://discuss.elastic.co/t/how-to-combine-multiple-xml-elements/153351 "2018-10-22T08:57:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![humalog](https://avatars.discourse-cdn.com/v4/letter/h/cc9497/32.png) [@humalog](https://discuss.elastic.co/u/humalog)\
**Post date:** [October 22, 2018, 8:57am UTC](https://discuss.elastic.co/t/how-to-combine-multiple-xml-elements/153351/1 "2018-10-22T08:57:06Z")

</div>

I'm trying to split XML file in multiple events. Here's a sample input:

```auto
<Report>
   <ReportHost name="1">
      <HostProperties>
        <tag name="os">linux</tag>
        <tag name="operating-sys">Linux Kernel 2.6</tag>
      </HostProperties>
      <ReportItem port="0" protocol="tcp">
         <description> This is a teeeest </description>
         <solution>n/a</solution>
      </ReportItem>
      <ReportItem port="8834" protocol="tcp">
         <description>Wrong CSP</description>
         <solution>Stop lieing</solution>
      </ReportItem>
   </ReportHost>
   <ReportHost name="2">
      <HostProperties>
         <tag name="os">windows</tag>
         <tag name="operating-system">Windows Server 2016</tag>
      </HostProperties>
      <ReportItem port="445" protocol="tcp">
         <description>teeeeeeeeeeest</description>
         <solution>WU</solution>
      </ReportItem> 
      <ReportItem port="0" protocol="tcp">
         <description>TESTnana</description>
         <solution>n/a</solution>
      </ReportItem>
   </ReportHost>
</Report>

```

I indexed single ReportItem events as followed:

```auto
input {
  file {
    path => "/home/test/test.xml"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    codec => multiline {
      pattern => "<ReportItem"
      negate => "true"
      what => "previous"
    }
  }
}

filter {
  xml {
    source => "message" 
    xpath => [
      "/ReportItem/@port","port",
      "/ReportItem/@protocol", "protocol",
      "//description/text()", "description",
      "//solution/text()", "solution",
    ]
  }
}

output {
  stdout { }
}

```

What is the best way to index to every event the _HostProperties_ element? How is it possible to address every single _tag_ element?

Best regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2018, 8:57am UTC](https://discuss.elastic.co/t/how-to-combine-multiple-xml-elements/153351/2 "2018-11-19T08:57:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.