# Issue parsing XML File with logstash

**URL:** https://discuss.elastic.co/t/issue-parsing-xml-file-with-logstash/128924
**Category:** Logstash
**Created:** [April 20, 2018, 6:15pm UTC](https://discuss.elastic.co/t/issue-parsing-xml-file-with-logstash/128924 "2018-04-20T18:15:40Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![rodher](https://avatars.discourse-cdn.com/v4/letter/r/50afbb/32.png) [@rodher](https://discuss.elastic.co/u/rodher)
#### Post date: [April 20, 2018, 6:15pm UTC](https://discuss.elastic.co/t/issue-parsing-xml-file-with-logstash/128924/1 "2018-04-20T18:15:40Z")

</div>

Hi to all

I have an XML file, and I'm parsing it with Logstash This is my filter section:

```
xml {
    source => message
    target => GLTData
    store_xml => true
  }

```

However, my xml file has only 2 fields: "Date", and "Message", and after the parser works, leave 2 variables.

The field "Message" is complex, and I like the parser split this field as well.

XML Example (before parser works)

`<LOGELEMENT><DATE>Apr 20, 2018 12:33:39 PM</DATE><MESSAGE><?xml version="1.0" encoding="ISO-8859-1"?><GLTData><BankId><![CDATA[9999]]></BankId><AppId><![CDATA[XYZ]]></AppId></GLTData></MESSAGE></LOGELEMENT>`

Fields create after parser works

```
 GLTData.DATE Apr 20, 2018 12:33:39 PM
    GLTData.MESSAGE {
      "GLTData": [
        {
          "BankID": [
            "9999"
          ],
          "AppID": [
            "XYZ"
          ],
       ]
       }

```

I want the field inside MESSAGE can identify as a variables, I mean:

```
GLTData.DATE
GLTData.MESSAGE.BankID          
GLTData.MESSAGE.AppID
.....

```

Some ideas about what modifications are neccesary? The XML structure is dynamic, I think XPath doesn't work

Thanks in advance

Dario R

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 18, 2018, 6:15pm UTC](https://discuss.elastic.co/t/issue-parsing-xml-file-with-logstash/128924/2 "2018-05-18T18:15:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.