# How to read XML logs
**URL:** https://discuss.elastic.co/t/how-to-read-xml-logs/104664
**Category:** Logstash
**Created:** [October 20, 2017, 7:43am UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664 "2017-10-20T07:43:17Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@abhisek](https://discuss.elastic.co/u/abhisek)
#### Post date: [October 20, 2017, 7:43am UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664/1 "2017-10-20T07:43:17Z")
Hi team,
My log file is "|" separated but two fields contains XML data. please let me know how can i read this.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 23, 2017, 5:18am UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664/2 "2017-10-23T05:18:32Z")
Please show an example.
---
### Author:  [@abhisek](https://discuss.elastic.co/u/abhisek)
#### Post date: [October 23, 2017, 7:09am UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664/3 "2017-10-23T07:09:20Z")
My Xml file looks like:
`1000|121|2017-07-18 15:14:25.893024|0|xxx.xxx.net|read|' iOBD mobility 911425152231426 '|' M136 While executing transform reformat for port out0: Index out of bounds in assignment for mapEntry.attributeValue. Index is 0 but vector has no elements. Source is the value "attribute_value_vec". '|1500390865`
As you can see my log is "|" separated and it has two xml data below are field in which my log need to be mapped.
```
txn_cd - 1000
user_id - 121
start_time - 2017-07-18 15:14:25.893024
status - 0
host -xxx.xxx.net
ser_name - read
request - ' iOBD mobility 911425152231426 '
response - ' M136 While executing transform reformat for port out0: Index out of bounds in assignment for mapEntry.attributeValue. Index is 0 but vector has no elements. Source is the value "attribute_value_vec". '
txn_id -1500390865
```
please help me with the configuration file.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 23, 2017, 1:10pm UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664/4 "2017-10-23T13:10:22Z")
You should be able to use a csv filter to split up the line into separate fields.
---
### Author:  [@abhisek](https://discuss.elastic.co/u/abhisek)
#### Post date: [October 24, 2017, 9:58am UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664/5 "2017-10-24T09:58:39Z")
Used the below config file to split the line
```
input {
file {
path => "abc/abc.dat"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
csv {
separator => "|"
columns => ["txn_cd","usr_id","event_ts","status","host","service_name","request","response","txn_id"]
}
date{
match => ["event_ts", "yyyy-MM-dd HH:mm:ss.SSSSSS"]
target => "event_ts"
}
mutate {convert => ["status", "integer"]}
}
output {
elasticsearch {
hosts => "http://abc:9200"
index => "xml"
}
stdout {}
}
```
but the fields are not properly matched
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 24, 2017, 1:12pm UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664/6 "2017-10-24T13:12:05Z")
> but the fields are not properly matched
Please elaborate. What _do_ you get?
---
### Author:  [@abhisek](https://discuss.elastic.co/u/abhisek)
#### Post date: [October 25, 2017, 10:38am UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664/7 "2017-10-25T10:38:54Z")
My output looks like this in kibana after loading
```
@timestamp October 25th 2017, 16:02:31.500
t @version 1
t _id AV9Rk1UH8A4YAHFNXmUV
t _index xml
# _score -
t _type logs
t host abc.abc.net
t message ||2017-07-18 15:40:16.836493|1|abc,abc.net|read|' iOBD mobility 911425152231426 '|' region ["VIVO", "VIVO", "OPPO", "OPPO", "OPPO", "OPPO"] msisdn "Maharashtra" imei "917756870222" imsi "911425152231426" device_vendor "404909092353805" device_type "E311" device_version "T2222" g3 "Yes" mms "Yes" gprs "Yes" streaming "Yes" ota "Yes" wap "Yes" os "Google" version "4.4.2" camera "Yes" apn ""AIRTELGPRS.COM,AIRTELMMS.COM"" '|1500392416
t path /abc/abc
t tags _csvparsefailure
```
Fields are not mapping according to the configuration file
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 25, 2017, 10:40am UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664/8 "2017-10-25T10:40:05Z")
As the `_csvparsefailure` tag indicates something goes wrong with the CSV parsing. The Logstash log should contain more information.
---
### Author:  [@abhisek](https://discuss.elastic.co/u/abhisek)
#### Post date: [October 25, 2017, 11:16am UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664/9 "2017-10-25T11:16:54Z")
Could you please help me on what extra information that need to be put in ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 25, 2017, 12:05pm UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664/10 "2017-10-25T12:05:53Z")
I meant that you should read the Logstash log file and look for clues about the CSV parse failure.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 22, 2017, 12:07pm UTC](https://discuss.elastic.co/t/how-to-read-xml-logs/104664/11 "2017-11-22T12:07:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.