# Logstash filter2

**URL:** <https://discuss.elastic.co/t/logstash-filter2/119207>\
**Category:** Logstash\
**Created:** [February 9, 2018, 10:11am UTC](https://discuss.elastic.co/t/logstash-filter2/119207 "2018-02-09T10:11:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rattisyam](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@rattisyam](https://discuss.elastic.co/u/rattisyam)\
**Post date:** [February 9, 2018, 10:11am UTC](https://discuss.elastic.co/t/logstash-filter2/119207/1 "2018-02-09T10:11:06Z")

</div>

please help me to create a filer conf file with pattern to below XML log.  
I am looking for the fileds "result","duration" and timestamp".

\<?xml version='1.0' encoding='UTF-8'?\>

\</hudson.plugins.git.Branch\>  
  
  
  
10  
\</hudson.plugins.git.util.Build\>  
  
  
  
  
  
  
\<hudson.model.CauseAction\>  
  
  
\<hudson.model.Cause\_-UserIdCause\>  
rattisyam  
\</hudson.model.Cause\_-UserIdCause\>  
1  
  
  
\</hudson.model.CauseAction\>  
\<jenkins.metrics.impl.TimeInQueueAction [plugin="metrics@3.1.2.10](mailto:plugin=%22metrics@3.1.2.10)"\>  
10  
\</jenkins.metrics.impl.TimeInQueueAction\>  
\<hudson.plugins.git.util.BuildData plugin="git@3.6.4"\>  
  
  
refs/remotes/origin/master  
\<hudson.plugins.git.util.Build\>  
  
0eae8a5c898e67eab676b5e95983ac11a20e7534  
  
\<hudson.plugins.git.Branch\>  
  
refs/remotes/origin/master

```
    <string>https://github.com/rattisyam/maven-project.git</string>
  </remoteUrls>
</hudson.plugins.git.util.BuildData>
<hudson.plugins.git.GitTagAction plugin="git@3.6.4">
  <tags class="hudson.util.CopyOnWriteMap$Tree">
    <entry>
      <string>refs/remotes/origin/master</string>
      <list/>
    </entry>
  </tags>
  <ws>/var/lib/jenkins/workspace/PackageJob</ws>
</hudson.plugins.git.GitTagAction>
<hudson.scm.SCMRevisionState_-None/>

```

 46 1517468093768 1517468093768 SUCCESS 138191 UTF-8 false /var/lib/jenkins/workspace/PackageJob 2.73.3 false 

Thank you.

Regards,  
Syam

---

<div class="post-metadata">

**Author:** ![rattisyam](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@rattisyam](https://discuss.elastic.co/u/rattisyam)\
**Post date:** [February 9, 2018, 10:12am UTC](https://discuss.elastic.co/t/logstash-filter2/119207/2 "2018-02-09T10:12:38Z")

</div>

\<?xml version='1.0' encoding='UTF-8'?\>

\</hudson.plugins.git.Branch\>  
  
  
  
10  
\</hudson.plugins.git.util.Build\>  
  
  
  
  
  
  
\<hudson.model.CauseAction\>  
  
  
\<hudson.model.Cause\_-UserIdCause\>  
rattisyam  
\</hudson.model.Cause\_-UserIdCause\>  
1  
  
  
\</hudson.model.CauseAction\>  
\<jenkins.metrics.impl.TimeInQueueAction [plugin="metrics@3.1.2.10](mailto:plugin=%22metrics@3.1.2.10)"\>  
10  
\</jenkins.metrics.impl.TimeInQueueAction\>  
\<hudson.plugins.git.util.BuildData plugin="git@3.6.4"\>  
  
  
refs/remotes/origin/master  
\<hudson.plugins.git.util.Build\>  
  
0eae8a5c898e67eab676b5e95983ac11a20e7534  
  
\<hudson.plugins.git.Branch\>  
  
refs/remotes/origin/master

```
    <string>https://github.com/rattisyam/maven-project.git</string>
  </remoteUrls>
</hudson.plugins.git.util.BuildData>
<hudson.plugins.git.GitTagAction plugin="git@3.6.4">
  <tags class="hudson.util.CopyOnWriteMap$Tree">
    <entry>
      <string>refs/remotes/origin/master</string>
      <list/>
    </entry>
  </tags>
  <ws>/var/lib/jenkins/workspace/PackageJob</ws>
</hudson.plugins.git.GitTagAction>
<hudson.scm.SCMRevisionState_-None/>

```

 46 1517468093768 1517468093768 SUCCESS 138191 UTF-8 false /var/lib/jenkins/workspace/PackageJob 2.73.3 false

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 9, 2018, 10:38am UTC](https://discuss.elastic.co/t/logstash-filter2/119207/3 "2018-02-09T10:38:06Z")

</div>

If you don't want your XML to get mangled you'll have to format it as preformatted text, e.g. using the `</>` toolbar button.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2018, 10:38am UTC](https://discuss.elastic.co/t/logstash-filter2/119207/4 "2018-03-09T10:38:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.