\
**Category:** Logstash\
**Created:** [April 25, 2019, 6:44pm UTC](https://discuss.elastic.co/t/how-to-handle-message-with-f1-value-f1-f3-value-f3/178521 "2019-04-25T18:44:39Z")\
**Posts on this page:** 3\
**Page:** 1
**Author:**  [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [April 25, 2019, 6:44pm UTC](https://discuss.elastic.co/t/how-to-handle-message-with-f1-value-f1-f3-value-f3/178521/1 "2019-04-25T18:44:39Z")
We have some logs where fields are separated with html like tags, value or phrase. The problem is that some messages have different fields and/or they may be in different orders.
Our SME's assistance was "Splunk just did it"
Thanks
---
**Author:**  [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 25, 2019, 7:47pm UTC](https://discuss.elastic.co/t/how-to-handle-message-with-f1-value-f1-f3-value-f3/178521/2 "2019-04-25T19:47:02Z")
You can use an xml filter to parse that. A filter can only consume one XML document at a time, so you would need to wrap it in an outer document. With that message
```
mutate { gsub => ["message", "^", "", "message", "$", ""] }
xml { source => "message" target => "theXML" }
```
would result in
```
"theXML" => {
"F1" => [
[0] "value"
],
"F3" => [
[0] "value"
]
}
```
You may also want to use the option force\_array =\> false.
---
**Author:**  [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 23, 2019, 7:47pm UTC](https://discuss.elastic.co/t/how-to-handle-message-with-f1-value-f1-f3-value-f3/178521/3 "2019-05-23T19:47:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.