# Logstash - How to format xml tags to show in Kibana

**URL:** <https://discuss.elastic.co/t/logstash-how-to-format-xml-tags-to-show-in-kibana/48708>\
**Category:** Logstash\
**Created:** [April 28, 2016, 4:33pm UTC](https://discuss.elastic.co/t/logstash-how-to-format-xml-tags-to-show-in-kibana/48708 "2016-04-28T16:33:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robert1](https://avatars.discourse-cdn.com/v4/letter/r/48db29/32.png) [@Robert1](https://discuss.elastic.co/u/Robert1)\
**Post date:** [April 28, 2016, 4:33pm UTC](https://discuss.elastic.co/t/logstash-how-to-format-xml-tags-to-show-in-kibana/48708/1 "2016-04-28T16:33:25Z")

</div>

I have the follow xml logs :

`<?xml version="1.0" encoding="UTF-8"?> <trail xmlns="http://xmlns.teste.com/testeas/schema/teste_trailtrail-20.7.xsd" xmlns:xsi="http://www.w3.org/2001/XML-teste" xsi:Location="http://xmlns.teste.com/testeas/schema/teste_trailtrail-20.7.xsd"> <Version>20.7</Version> <trailRecord><trail_Type>8</trail_Type><EntryId>1</EntryId><Extended_Timestamp>2009-04-26T15:19:16.486475Z</Extended_Timestamp><SE_User>/</SE_User><OS_User>teste</OS_User><Userhost>alpha.localdomain</Userhost><OS_Process>2708</OS_Process><Terminal>pts/2</Terminal><Instance>0</Instance><Returncode>0</Returncode><OSPrivilege>ADMIN</OSPrivilege><SEID>1410052295</SEID> <Text_Text>CONNECT</Text_Text> </trailRecord> </trail>`

And i have the follow filter:

` if [type] == "testebd"{  
multiline {  
pattern =\> "^\s|\<_|^[A-Za-z]._\>"  
what =\> "previous"  
}  
mutate {  
remove\_field =\> ["entry", "[audit][xmlns]", "[audit][xmlns:xsi]"]  
replace =\> ["[AuditRecord][Audit\_Type]", "%{[AuditRecord][Audit\_Type]}" ]

```
}
    xml {

source => "message"
target => "audit"

        xpath => ["/AuditRecord/Audit_Type/text()","Audit_Type"]
        xpath => ["/AuditRecord/EntryId/text()","EntryId"]

    }

 }`

```

And the follow output in Kibana:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/1/1cf39779633394d334faaa47c4455bbeae0cc465.jpg)

I want to show the "trail\_Type" , "EntryId", "Extended\_Timestamp", "SE \_User", "OS\_User" fields ... indexed.  
Could you help me to troubleshoot this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:00am UTC](https://discuss.elastic.co/t/logstash-how-to-format-xml-tags-to-show-in-kibana/48708/2 "2017-07-06T05:00:07Z")

</div>