# Logstash Filter for XML file

**URL:** <https://discuss.elastic.co/t/logstash-filter-for-xml-file/119956>\
**Category:** Logstash\
**Created:** [February 15, 2018, 10:00am UTC](https://discuss.elastic.co/t/logstash-filter-for-xml-file/119956 "2018-02-15T10:00:52Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![charan.gandra](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\
**Post date:** [February 15, 2018, 10:00am UTC](https://discuss.elastic.co/t/logstash-filter-for-xml-file/119956/1 "2018-02-15T10:00:52Z")

</div>

Hi,

I am looking to parse multiple XML files and can't find a suitable filter in Logstash for the same. I've around 50 XML files in different sub folders but all should have same structure as it is an output of pnp4nagios. I am looking to parse and send the below key values to elasticsearch.

\<NAGIOS\_AUTH\_HOSTNAME\>remotehost1\</NAGIOS\_AUTH\_HOSTNAME\>  
\<NAGIOS\_AUTH\_SERVICEDESC\>Zombie Processes\</NAGIOS\_AUTH\_SERVICEDESC\>  
\<NAGIOS\_PERFDATA\>procs=0;5;10;0; \</NAGIOS\_PERFDATA\>  
\<NAGIOS\_SERVICEPERFDATA\>procs=0;5;10;0;\</NAGIOS\_SERVICEPERFDATA\>  
\<NAGIOS\_SERVICESTATE\>OK\</NAGIOS\_SERVICESTATE\>

Here is my sample XML file.

\<?xml version="1.0" encoding="UTF-8" standalone="yes"?\> check\_nrpe /usr/local/pnp4nagios/var/perfdata/remotehost1/Zombie\_Processes.rrd SINGLE 8460 0 1 procs procs 0 5 10 0 0 successful updated remotehost1 Zombie Processes check\_nrpe!check\_zombie\_procs SERVICEPERFDATA remotehost1 Zombie Processes remotehost1 UP HARD procs=0;5;10;0; /usr/local/pnp4nagios/var/perfdata/remotehost1/Zombie\_Processes.rrd check\_nrpe!check\_zombie\_procs Zombie\_Processes procs=0;5;10;0; OK HARD 1518688537 /usr/local/pnp4nagios/var/perfdata/remotehost1/Zombie\_Processes.xml 4

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 15, 2018, 10:32am UTC](https://discuss.elastic.co/t/logstash-filter-for-xml-file/119956/2 "2018-02-15T10:32:37Z")

</div>

> Here is my sample XML file.
> 
> \<?xml version="1.0" encoding="UTF-8" standalone="yes"?\> check\_nrpe /usr/local/pnp4nagios/var/perfdata/remotehost1/Zombie\_Processes.rrd SINGLE 8460 0 1 procs procs 0 5 10 0 0 successful updated remotehost1 Zombie Processes check\_nrpe!check\_zombie\_procs SERVICEPERFDATA remotehost1 Zombie Processes remotehost1 UP HARD procs=0;5;10;0; /usr/local/pnp4nagios/var/perfdata/remotehost1/Zombie\_Processes.rrd check\_nrpe!check\_zombie\_procs Zombie\_Processes procs=0;5;10;0; OK HARD 1518688537 /usr/local/pnp4nagios/var/perfdata/remotehost1/Zombie\_Processes.xml 4

This isn't XML. Try formatting it as preformatted text using the `</>` toolbar button so the forum software doesn't strip the XML tags.

---

<div class="post-metadata">

**Author:** ![charan.gandra](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\
**Post date:** [February 15, 2018, 10:50am UTC](https://discuss.elastic.co/t/logstash-filter-for-xml-file/119956/3 "2018-02-15T10:50:41Z")

</div>

```
<?xml version="1.0" encoding="UTF-8"?>
<NAGIOS>
   <DATASOURCE>
      <TEMPLATE>check_nrpe</TEMPLATE>
      <RRDFILE>/usr/local/pnp4nagios/var/perfdata/remotehost1/Zombie_Processes.rrd</RRDFILE>
      <RRD_STORAGE_TYPE>SINGLE</RRD_STORAGE_TYPE>
      <RRD_HEARTBEAT>8460</RRD_HEARTBEAT>
      <IS_MULTI>0</IS_MULTI>
      <DS>1</DS>
      <NAME>procs</NAME>
      <LABEL>procs</LABEL>
      <UNIT />
      <ACT>0</ACT>
      <WARN>5</WARN>
      <WARN_MIN />
      <WARN_MAX />
      <WARN_RANGE_TYPE />
      <CRIT>10</CRIT>
      <CRIT_MIN />
      <CRIT_MAX />
      <CRIT_RANGE_TYPE />
      <MIN>0</MIN>
      <MAX />
   </DATASOURCE>
   <RRD>
      <RC>0</RC>
      <TXT>successful updated</TXT>
   </RRD>
   <NAGIOS_AUTH_HOSTNAME>remotehost1</NAGIOS_AUTH_HOSTNAME>
   <NAGIOS_AUTH_SERVICEDESC>Zombie Processes</NAGIOS_AUTH_SERVICEDESC>
   <NAGIOS_CHECK_COMMAND>check_nrpe!check_zombie_procs</NAGIOS_CHECK_COMMAND>
   <NAGIOS_DATATYPE>SERVICEPERFDATA</NAGIOS_DATATYPE>
   <NAGIOS_DISP_HOSTNAME>remotehost1</NAGIOS_DISP_HOSTNAME>
   <NAGIOS_DISP_SERVICEDESC>Zombie Processes</NAGIOS_DISP_SERVICEDESC>
   <NAGIOS_HOSTNAME>remotehost1</NAGIOS_HOSTNAME>
   <NAGIOS_HOSTSTATE>UP</NAGIOS_HOSTSTATE>
   <NAGIOS_HOSTSTATETYPE>HARD</NAGIOS_HOSTSTATETYPE>
   <NAGIOS_MULTI_PARENT />
   <NAGIOS_PERFDATA>procs=0;5;10;0;</NAGIOS_PERFDATA>
   <NAGIOS_RRDFILE>/usr/local/pnp4nagios/var/perfdata/remotehost1/Zombie_Processes.rrd</NAGIOS_RRDFILE>
   <NAGIOS_SERVICECHECKCOMMAND>check_nrpe!check_zombie_procs</NAGIOS_SERVICECHECKCOMMAND>
   <NAGIOS_SERVICEDESC>Zombie_Processes</NAGIOS_SERVICEDESC>
   <NAGIOS_SERVICEPERFDATA>procs=0;5;10;0;</NAGIOS_SERVICEPERFDATA>
   <NAGIOS_SERVICESTATE>OK</NAGIOS_SERVICESTATE>
   <NAGIOS_SERVICESTATETYPE>HARD</NAGIOS_SERVICESTATETYPE>
   <NAGIOS_TIMET>1518688537</NAGIOS_TIMET>
   <NAGIOS_XMLFILE>/usr/local/pnp4nagios/var/perfdata/remotehost1/Zombie_Processes.xml</NAGIOS_XMLFILE>
   <XML>
      <VERSION>4</VERSION>
   </XML>
</NAGIOS>`Preformatted text`
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 15, 2018, 1:53pm UTC](https://discuss.elastic.co/t/logstash-filter-for-xml-file/119956/4 "2018-02-15T13:53:58Z")

</div>

Just use an xml filter. Its `xpath` option makes it easy to extract the contents of certain XML tags into certain fields.

---

<div class="post-metadata">

**Author:** ![charan.gandra](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\
**Post date:** [February 15, 2018, 2:05pm UTC](https://discuss.elastic.co/t/logstash-filter-for-xml-file/119956/5 "2018-02-15T14:05:19Z")

</div>

Thank you very much for you advise. I am fairely new to this topic and not sure how to use an xml filter. Is it possible to provide me an example.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 15, 2018, 2:38pm UTC](https://discuss.elastic.co/t/logstash-filter-for-xml-file/119956/6 "2018-02-15T14:38:18Z")

</div>

There are lots of examples in post threads, e.g. here: [Need a complete XML Filter example](https://discuss.elastic.co/t/need-a-complete-xml-filter-example/35398/3)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2018, 2:38pm UTC](https://discuss.elastic.co/t/logstash-filter-for-xml-file/119956/7 "2018-03-15T14:38:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.