### Author:  [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)
#### Post date: [June 15, 2021, 8:54am UTC](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964/1 "2021-06-15T08:54:25Z")
Hello,
I have parsed the XML log format coming from a syslog source as defined in logstash config file. What shall be done further to parse the syslog message field within the XML?
Below is the config:
input
{
tcp
{
mode =\> "server"
host =\> "0.0.0.0"
port =\> 6514
ssl\_enable =\> true
ssl\_verify =\> false
ssl\_cert =\> "/opt/logstash/ssl/logstash-remote.crt"
ssl\_key =\> "/opt/logstash/ssl/logstash-remote.key"
}
}
filter {
grok {
match =\> { "message" =\> '%{SYSLOG5424LINE}' }
}
mutate {
remove\_field =\> ["message"]
remove\_field =\> ["syslog5424\_sd"]
remove\_field =\> ["@timestamp"]
rename =\> { "syslog5424\_ts" =\> "Timestamp" }
rename =\> { "syslog5424\_host" =\> "Source\_Host" }
rename =\> { "syslog5424\_msgid" =\> "Message\_ID" }
rename =\> { "syslog5424\_app" =\> "Type" }
gsub =\> ["syslog5424\_msg",'"','"']
```
}
```
xml {
source =\> "syslog5424\_msg"
store\_xml =\> false
}
}
output
{
elasticsearch {
hosts =\> ["x.x.x.x:9200"]
index =\> "index-%{+YYYY.MM.dd}"
}
}
and here is the json log that I am trying to parse further:
{
"\_index": "index-2021.06.15",
"\_type": "\_doc",
"\_id": "QGCoDnoBQqtAWexfwnd-",
"\_version": 1,
"\_score": null,
"\_source": {
"host": "x.x.x.x",
"syslog5424\_msg": "\{d5599ed8-6520-11eb-1f73-00090faa0001}xyzABCDEFGHx.x.x.x1.1.1.116Windows-480\123402021-06-15T07:06:13Whatever202004090AMCore4467.0syslogagent3000UpdateTaskAnythingN/A \r",
"syslog5424\_pri": "29",
"syslog5424\_ver": "1",
"port": 56648,
"Type": "Events",
"Source\_Host": "syslog server",
"@version": "1",
"Message\_ID": "EventFwd",
"@timestamp": "2021-06-15T07:52:58.582Z",
"Timestamp": "2021-06-15T07:52:58.0Z"
},
"fields": {
"@timestamp": [
"2021-06-15T07:52:58.582Z"
],
"X\_Timestamp": [
"2021-06-15T07:52:58.000Z"
]
},
"sort": [
1623743578582
]
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 15, 2021, 2:15pm UTC](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964/2 "2021-06-15T14:15:21Z")
> [@devashishsingh](#):
>
> xml {
> source =\> "syslog5424\_msg"
> store\_xml =\> false
> }
If store\_xml is false and you are not using xpath what do you expect this to do?
---
### Author:  [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)
#### Post date: [June 15, 2021, 2:39pm UTC](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964/3 "2021-06-15T14:39:09Z")
Ok so store\_xml has to be true and would you please help me to give XPATH syntax applied to my data below(just one line should be really helpful 🙂 ) say extracting IP address and it's value. Here's is the XML of syslog message if needed:
```auto
{cfe0cba8-5f98-11eb-31fd-04ea56651f3a}
HOSTNAME
04EAAJBBS6788GG
x.x.x.x
9.9.10.19
Windows 10
-480
Mrs. abc
2401
0
2021-06-14T04:05:23
AMCORDAT2000
0409
0
AMCore
4466.0
EPOAGENT3000
UpdateTask
McAfeeHttp
N/A
```
Thank you,
Devashish Singh
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 15, 2021, 2:44pm UTC](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964/4 "2021-06-15T14:44:36Z")
There are multiple examples of using xpath in this forum. [This](https://discuss.elastic.co/t/help-logstash-xml-parsing-to-xpath/241051/2) for example.
---
### Author:  [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)
#### Post date: [June 15, 2021, 2:47pm UTC](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964/5 "2021-06-15T14:47:54Z")
Well I have been through a lot before but this seems almost matching my own scenario.
Thanks @Badger , I will keep it open.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 13, 2021, 2:48pm UTC](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964/6 "2021-07-13T14:48:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.