# Logstash expecting \\n for it to process an XML

**URL:** <https://discuss.elastic.co/t/logstash-expecting-n-for-it-to-process-an-xml/101941>\
**Category:** Logstash\
**Created:** [September 27, 2017, 7:34am UTC](https://discuss.elastic.co/t/logstash-expecting-n-for-it-to-process-an-xml/101941 "2017-09-27T07:34:18Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![aggarwalJitesh94](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aggarwaljitesh94/32/22556_2.png) [@aggarwalJitesh94](https://discuss.elastic.co/u/aggarwalJitesh94)\
**Post date:** [September 27, 2017, 7:34am UTC](https://discuss.elastic.co/t/logstash-expecting-n-for-it-to-process-an-xml/101941/1 "2017-09-27T07:34:18Z")

</div>

Hello Team,

I am trying to parse through an XML file and read only a single tag out of the entire XML using the Grok Patterns.

My grok pattern looks like this. Its able to parse through an XML when its properly indented, as there's a new line after each closing tag. But when the file comes with no spaces in between consecutive tags, this pattern does not work. Could anyone help here?

filter {  
#ignore log comments  
if [message] =~ "^#" {  
drop {}  
}

grok {  
patterns\_dir =\> "./patterns"  
match =\> ["message", "%{DATA:extras}\<LoadID%{DATA:extra}\>%{DATA:ASNNumber}%{GREEDYDATA:behind}"]  
}  
date {  
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]  
locale =\> "en"  
}  
}

# Second filter

filter {  
if "\_grokparsefailure" in [tags] {  
drop { }  
} else {  
# on success remove the message field to save space  
mutate {  
remove\_field =\> ["message", "timestamp", "extra", "extras", "behind"]  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 27, 2017, 9:17am UTC](https://discuss.elastic.co/t/logstash-expecting-n-for-it-to-process-an-xml/101941/2 "2017-09-27T09:17:16Z")

</div>

I suggest you use an xml filter to parse XML.

---

<div class="post-metadata">

**Author:** ![aggarwalJitesh94](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aggarwaljitesh94/32/22556_2.png) [@aggarwalJitesh94](https://discuss.elastic.co/u/aggarwalJitesh94)\
**Post date:** [September 27, 2017, 9:19am UTC](https://discuss.elastic.co/t/logstash-expecting-n-for-it-to-process-an-xml/101941/3 "2017-09-27T09:19:31Z")

</div>

I am not really sure how to go about about it?  
Can you please suggest changes in my existing filters?  
I only need to read the value of the tag  
`<LoadID></LoadID> or <LoadID xmlns=""></LoadID>`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 27, 2017, 9:46am UTC](https://discuss.elastic.co/t/logstash-expecting-n-for-it-to-process-an-xml/101941/4 "2017-09-27T09:46:21Z")

</div>

I can't help without knowing what the data looks like. What does a `stdout { codec => rubydebug }` output produce?

---

<div class="post-metadata">

**Author:** ![aggarwalJitesh94](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aggarwaljitesh94/32/22556_2.png) [@aggarwalJitesh94](https://discuss.elastic.co/u/aggarwalJitesh94)\
**Post date:** [September 27, 2017, 9:58am UTC](https://discuss.elastic.co/t/logstash-expecting-n-for-it-to-process-an-xml/101941/5 "2017-09-27T09:58:13Z")

</div>

This works fine for me.

```
<tns:ASNAck xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tns="http://www.xyx.com/YYY/logistics/mxg/xnsds/V1_0">
    <MessageHeader>
        <MessageID>20170704080189</MessageID>
        <MessageTimeStamp>2017-07-04T20:17:30Z</MessageTimeStamp>
        <SenderID>KNN_DAO_MXC</SenderID>
        <ReceiverID>GOLF_DAO</ReceiverID>
        <MessageType>InboundASNAck</MessageType>
        <CorrelationID>2d383736363033383337333530313338</CorrelationID>
    </MessageHeader>
    <MasterWaybill>C211</MasterWaybill>
    <LoadID>10112275912A02</LoadID>
    <Accept>true</Accept>
    <ReasonCode>0</ReasonCode>
    <ReasonDescription/>
</tns:ASNAck>

```

This doesn't work:

`<?xml version="1.0" encoding="UTF-8" standalone="yes" ?><tns:ASNAck xmlns:tns='http://www.xyx.com/YYY/logistics/mxg/xnsds/V1_0' xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'><MessageHeader><MessageID>3031999515</MessageID><MessageTimeStamp>2017-09-12T06:37:36Z</MessageTimeStamp><SenderID>XBHSNS</SenderID><ReceiverID>GOLF_DAO</ReceiverID><MessageType>ACKACKACK</MessageType><CorrelationID>2d323537383935353034383933383135</CorrelationID></MessageHeader><Masterbill>G829441</Masterbill><LoadID>Jitesh555</LoadID><Accept>true</Accept><ReasonCode/><ReasonDescription/></tns:ASNAck>`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 27, 2017, 10:18am UTC](https://discuss.elastic.co/t/logstash-expecting-n-for-it-to-process-an-xml/101941/6 "2017-09-27T10:18:09Z")

</div>

That's not the output from `stdout { codec => rubydebug }`. For best results please answer my questions. I'd also like to see the complete configuration (specifically your inputs).

---

<div class="post-metadata">

**Author:** ![aggarwalJitesh94](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aggarwaljitesh94/32/22556_2.png) [@aggarwalJitesh94](https://discuss.elastic.co/u/aggarwalJitesh94)\
**Post date:** [September 27, 2017, 10:23am UTC](https://discuss.elastic.co/t/logstash-expecting-n-for-it-to-process-an-xml/101941/7 "2017-09-27T10:23:45Z")

</div>

```
input {
  beats {
    port => 5045
    type => 'iis'
  }

}

```

This is my input. There is nothing in the ruby debug as the pattern doesn't match

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 27, 2017, 11:11am UTC](https://discuss.elastic.co/t/logstash-expecting-n-for-it-to-process-an-xml/101941/8 "2017-09-27T11:11:43Z")

</div>

> There is nothing in the ruby debug as the pattern doesn't match

Then stop dropping non-matching events so that all events are routed to the stdout output

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2017, 11:12am UTC](https://discuss.elastic.co/t/logstash-expecting-n-for-it-to-process-an-xml/101941/9 "2017-10-25T11:12:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.