# Logstash Filter Use
**URL:** https://discuss.elastic.co/t/logstash-filter-use/154188
**Category:** Logstash
**Created:** [October 26, 2018, 11:36am UTC](https://discuss.elastic.co/t/logstash-filter-use/154188 "2018-10-26T11:36:40Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Miguel\_Leite](https://discuss.elastic.co/u/Miguel_Leite)
#### Post date: [October 26, 2018, 11:36am UTC](https://discuss.elastic.co/t/logstash-filter-use/154188/1 "2018-10-26T11:36:40Z")
Hello.
I'm trying to parse a specific log event in xml. I used the xml filter with the target =\> "parsed\_listen".
After running it creates a field "parsed\_listen.txt" with the message from the log... Now I want to parse that field with the kv filter. But I don't seem to be able to use the kv filter having the source =\> "parsed\_listen.txt"...
Any thoughts on that?
Thanks!!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 27, 2018, 9:43am UTC](https://discuss.elastic.co/t/logstash-filter-use/154188/2 "2018-10-27T09:43:22Z")
Please don't _describe_ your configuration, _show_ it.
---
### Author:  [@Miguel\_Leite](https://discuss.elastic.co/u/Miguel_Leite)
#### Post date: [October 29, 2018, 8:57am UTC](https://discuss.elastic.co/t/logstash-filter-use/154188/3 "2018-10-29T08:57:05Z")
This is part of my logstash configuration...
```
else if "listen_xml" in [tags] {
xml {
source => "message"
target => "parsed_listen"
force_array => false
force_content => true
add_tag => ["xml_applied"]
}
if "xml_applied" in [tags] {
grok {
match => { "parsed_listen.txt" => ["%{MONTHDAY}-%{DATA}-%{YEAR} %{TIME} /* %{DATA:[service]} /* %{DATA:[host]} /* %{INT:[return_code]}"] }
add_tag => ["passed"]
}
}
```
The "parsed\_listen.txt" is the variable to be parsed, as it contains the log information that I want, after using the xml filter... Is it possible to grok matching the target of the xml filter?
Thanks!!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 29, 2018, 9:48pm UTC](https://discuss.elastic.co/t/logstash-filter-use/154188/4 "2018-10-29T21:48:41Z")
Where and how is the `parsed_listen.txt` field created? The xml filter above only creates a `parsed_listen` field.
---
### Author:  [@Miguel\_Leite](https://discuss.elastic.co/u/Miguel_Leite)
#### Post date: [October 30, 2018, 10:10am UTC](https://discuss.elastic.co/t/logstash-filter-use/154188/5 "2018-10-30T10:10:48Z")
I'm not sure, but it was created by the xml filter... After it I could see the field created in Kibana... All I had to do to resolve this issue was:
`mutate { rename => {"[parsed_listen][txt]" => "[parsed_txt]"} }`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 27, 2018, 10:11am UTC](https://discuss.elastic.co/t/logstash-filter-use/154188/6 "2018-11-27T10:11:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.