# Logstash not parsing my XML

**URL:** <https://discuss.elastic.co/t/logstash-not-parsing-my-xml/131582>\
**Category:** Logstash\
**Created:** [May 12, 2018, 4:20pm UTC](https://discuss.elastic.co/t/logstash-not-parsing-my-xml/131582 "2018-05-12T16:20:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![harish\_c](https://avatars.discourse-cdn.com/v4/letter/h/eb8c5e/32.png) [@harish\_c](https://discuss.elastic.co/u/harish_c)\
**Post date:** [May 12, 2018, 4:20pm UTC](https://discuss.elastic.co/t/logstash-not-parsing-my-xml/131582/1 "2018-05-12T16:20:55Z")

</div>

I have been slogging all day to get this to work but no luck yet. There are number of questions with xml and tried every suggestion and it still doesn't.

Here's my basic XML:

> ```
> <?xml version="1.0" encoding="UTF-8"?>
> <players>
> <player>
> <name>Zidane</name>
> <club>Real Madrid</club>
> <country>France</country>
> </player>
> <player>
> <name>Luis Figo</name>
> <club>Real Madrid</club>
> <country>Portugal</country>
> </player>
> <player>
> <name>Ronaldo</name>
> <club>Barcelona F.C</club>
> <country>Brazil</country>
> </player>
> </players>
> 
> ```

And the `.conf` file:

> ```
> input {
> file {
> path => "/Users/chndha/Documents/ELK/data/sample/test.xml"
> type => "xml"
> start_position => beginning
> sincedb_path => "/dev/null"
> ignore_older => 0
> codec => multiline {
> pattern => "^<players>"
> negate => "true"
> what => "previous"
> max_lines => 5000
> }
> }
> }
> filter {
> xml {
> source => "message"
> target => "parsed"
> store_xml => "false"
> xpath => [
> "/player", "player",
> "/player//name", "player_name"
> ]
> }
> split {
> field => player
> }
> mutate {
> remove_field => ["message", "parsed"]
> }
> }
> output {
> stdout { codec => "rubydebug" }
> }
> 
> ```

and yes, I have tried without the split and that didn't work either. Nothing is printed to console.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 13, 2018, 8:40pm UTC](https://discuss.elastic.co/t/logstash-not-parsing-my-xml/131582/2 "2018-05-13T20:40:00Z")

</div>

Do not delete fields until you are sure they contain what you expect. You are not getting any messages because your multiline codec is never seeing lines starting with \<players\>, since that is indented. You can add 'auto\_flush\_interval =\> 3' to force the codec to emit an event.

At some point you will find you want to get rid of the newlines embedded by the codec, which can be done using

```auto
mutate { gsub => [ "message", "
", "" ] }

```

At that point xpath =\> ["//player"] (double slash) will work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2018, 8:40pm UTC](https://discuss.elastic.co/t/logstash-not-parsing-my-xml/131582/3 "2018-06-10T20:40:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.