# Issue with my logstash conf file
**URL:** https://discuss.elastic.co/t/issue-with-my-logstash-conf-file/118983
**Category:** Logstash
**Created:** [February 8, 2018, 7:18am UTC](https://discuss.elastic.co/t/issue-with-my-logstash-conf-file/118983 "2018-02-08T07:18:47Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@rattisyam](https://discuss.elastic.co/u/rattisyam)
#### Post date: [February 8, 2018, 7:18am UTC](https://discuss.elastic.co/t/issue-with-my-logstash-conf-file/118983/1 "2018-02-08T07:18:47Z")
Hi Team,
I am very new to ELK stack.
I am trying to parse jenkins XML (buil.xml) logs through xml parser. but i could not make it.
could you please help me on this.
below is my conf file:
input {
file {
path =\> "/var/lib/jenkins/jobs/_/builds/_/build.xml"
sincedb\_path =\> "/dev/null"
start\_position =\> "beginning"
type =\> "jenkinsxmllog"
}
}
filter {
xml {
store\_xml =\> true
source =\> message
target =\> parsed\_xml
force\_array =\> false
remove\_field =\> "message"
add\_field =\> { "status" =\> "%{[parsed\_xml][result]} }
add\_field =\> { "build\_duration" =\> "%{[parsed\_xml][duration]} }
add\_field =\> { "timestamp" =\> "%{[parsed\_xml][timestamp]} }
}
```
mutate {
convert => { "status" => "string" }
convert => { "timestamp" => "string" }
convert => { "build_duration" => "integer" }
}
```
}
output {
elasticsearch {
hosts =\> ["54.89.237.179:9200"]
index =\> "jenkinsxmldemo2"
document\_type =\> "demoxml2"
}
stdout { codec =\> rubydebug }
}
Thanks in advance.
Regards,
Syam
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 8, 2018, 7:22am UTC](https://discuss.elastic.co/t/issue-with-my-logstash-conf-file/118983/2 "2018-02-08T07:22:49Z")
> [@rattisyam](#):
>
> but i could not make it.
What problems are you having?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 8, 2018, 8:05am UTC](https://discuss.elastic.co/t/issue-with-my-logstash-conf-file/118983/3 "2018-02-08T08:05:25Z")
The file input reads files line by line. To read a whole file you need to use a multiline codec. Examples have been posted in the past.
---
### Author:  [@rattisyam](https://discuss.elastic.co/u/rattisyam)
#### Post date: [February 8, 2018, 8:25am UTC](https://discuss.elastic.co/t/issue-with-my-logstash-conf-file/118983/4 "2018-02-08T08:25:13Z")
configurations error in logstash logs.
"[2018-02-08T08:23:08,677][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, } at line 196, column 19 (byte 3267) after filter {\n xml {\n store\_xml =\> true\n source =\> "message"\n target =\> "parsed\_xml"\n\t\tforce\_array =\> false\n\t\tremove\_field =\> "message"\n\t\tadd\_field =\> { "status" =\> "%{[parsed\_xml][result]} }\t\n\t\tadd\_field =\> { "", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:171:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:335:in `block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in`with\_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:332:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:319:in `converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in`block in converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in`converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:343:in`block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}
"
---
### Author:  [@rattisyam](https://discuss.elastic.co/u/rattisyam)
#### Post date: [February 8, 2018, 8:25am UTC](https://discuss.elastic.co/t/issue-with-my-logstash-conf-file/118983/5 "2018-02-08T08:25:46Z")
thank you.could u please provide the example link.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 8, 2018, 9:39am UTC](https://discuss.elastic.co/t/issue-with-my-logstash-conf-file/118983/6 "2018-02-08T09:39:59Z")
> add\_field =\> { "status" =\> "%{[parsed\_xml][result]} }
> add\_field =\> { "build\_duration" =\> "%{[parsed\_xml][duration]} }
> add\_field =\> { "timestamp" =\> "%{[parsed\_xml][timestamp]} }
There's a missing double quote on each line here.
> could u please provide the example link.
I don't have time to dig that up for you.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 8, 2018, 9:39am UTC](https://discuss.elastic.co/t/issue-with-my-logstash-conf-file/118983/7 "2018-03-08T09:39:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.