# LOGSTASH - MULTILINE XML IN LOG

**URL:** <https://discuss.elastic.co/t/logstash-multiline-xml-in-log/280528>\
**Category:** Logstash\
**Created:** [August 5, 2021, 11:37am UTC](https://discuss.elastic.co/t/logstash-multiline-xml-in-log/280528 "2021-08-05T11:37:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel\_Lopez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_lopez/32/50639_2.png) [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\
**Post date:** [August 5, 2021, 11:37am UTC](https://discuss.elastic.co/t/logstash-multiline-xml-in-log/280528/1 "2021-08-05T11:37:32Z")

</div>

Hi to all

I'm trying to parse xml info that it is in a log file, I tried with different configs, without luck, the actual one is this, but I tried with TIMESTAMP too, and join lines without sense

```auto
codec => multiline{
 chartset => "UTF-8"
 pattern => "^.*?\<"
 negate => true
 what => "next"
} 

or

codec => multiline{
 chartset => "UTF-8"
 pattern => "^%{TIMESTAMP_ISO8601}"
 negate => true
 what => "previous"
}

Log Example

021-08-05 09:31:19,085 5595322766 ERROR [java] (Thread-1080919:) Missing Configuration 
2021-08-05 09:31:19,085 5595322766 ERROR [java] (Thread-1080919:) ExporterMessageTaskHandler, 
2021-08-05 09:31:19,085 5595322766 INFO [java] (Thread-1080919:) ExporterMessageTaskHandler, 
2021-08-05 09:31:19,085 5595322766 INFO [java] (Thread-1080919:) ExporterMessageTaskHandler is finished 
2021-08-05 09:31:19,459 5595323140 INFO [java] (Thread-1080931:) XML To FTP: 
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<request>
    <request_id>111222333</request_id>
    <request_mode>1</request_mode>
    <is_urgent>0</is_urgent>

        <warrant_attachment>
             <file_content>JVBERi0xLjMNJeLjz9MNCjEgMCBvYmoNPDwvTWV0YWRhdGEgOCAwIFIvUGFnZXMgMiAwIFIvVHlwZS9DYXRhbG9nPj4NZW5kb2JqDTIgMCBvYmoNPDwvTWVkaWFCb3hbMC4wIDAuMCA1OTEuODQgODM3LjEyXS9Db3VudCAxL1R5cGUvUGFnZXMvS2lkc1s0IDAgUl0+Pg1lbmRvYmoNNCAwIG9iag08PC9QYXJlbnQgMiAwIFIvQ29udGVudHMgNiAwIFIvUGllY2VJbmZvPDwvUFNMPDwvUHJpdmF0ZTw8L1YoMy4yLjkpPj4vTGFzdE1vZGlmaWVkKEQ6MjAyMTA4MDUwNzQ1NDQtMDAnMDAnKT4+Pj4vTWVkaWFCb3hbMC4wIDAuMCA1OTEuODQgODM3LjEyXS9SZXNvdXJjZXM8PC9YT2JqZWN0PDwvSW0wIDUgMCBSPj4vUHJvY1NldFsvUERGL0ltYWdlQl0+Pi9UeXBlL1BhZ2U+Pg1l</file_content>
        </warrant_attachment>
    
    
    <request_type>
        <target_key>
            <name>PEPE</name>
            <case_id>PEPE_CASE</case_id>
         
           
        </target_key>
    </request_type>
</request>

2021-08-05 09:31:27,509 5595331190 ERROR [java] (Thread-14:) java Config Exception 

2021-08-05 09:31:37,539 5595341220 ERROR [java] (Thread-14:) java

```

The label file\_content is huge, but it is not the issue, the issue is that lines with date joins together, with both config, and I only what to join XML labels into one line to grok the message.

Could any have another idea?

BR

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 2, 2021, 11:37am UTC](https://discuss.elastic.co/t/logstash-multiline-xml-in-log/280528/2 "2021-09-02T11:37:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.