# Logstash parsing string+xml

**URL:** <https://discuss.elastic.co/t/logstash-parsing-string-xml/99907>\
**Category:** Logstash\
**Created:** [September 8, 2017, 10:23pm UTC](https://discuss.elastic.co/t/logstash-parsing-string-xml/99907 "2017-09-08T22:23:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElkPdxUser](https://avatars.discourse-cdn.com/v4/letter/e/c68b51/32.png) [@ElkPdxUser](https://discuss.elastic.co/u/ElkPdxUser)\
**Post date:** [September 8, 2017, 10:23pm UTC](https://discuss.elastic.co/t/logstash-parsing-string-xml/99907/1 "2017-09-08T22:23:50Z")

</div>

Hello,

I need to get the transaction id from the input message. During execution, the config script runs without error, however, it is not able to parse the transaction id from the xml. Any help?

Log Input:

2017-09-05 08:12:52,508 DEBUG com.demo.GetInsuredImpl.lookup [default-threads - 35] - The request to InsuredService is \<?xml version="1.0" encoding="UTF-8"??\>test170905081252

Logstash filter:

```
# Check if GROK parse failure and try another format
grok {
  remove_tag => ["_grokparsefailure"]
  match => { "message" => "%{TIMESTAMP_ISO8601:logTimeStamp} %{LOGLEVEL:level} (com.demo.(?:[a-zA-Z0-9-]+\.)+[A-Za-z0-9$]+)( \[default-threads - %{DATA:thread}\])?( \[%{WORD}\/%{IP:sic-server-ip}:%{POSINT}(-${INT:temp_int})?\])? (- )?(%{GREEDYDATA:entryMessage})?" }
}

# Parse the XML string from the log entry message
grok {
  remove_tag => ["_grokparsefailure"]
  match => { "entryMessage" => "(%{GREEDYDATA:temp_pref})?(\<\?xml version=\"1.0\")( encoding=\"UTF-8\")?(\?\>)%{GREEDYDATA:xmlinput}" }
}

if [xmlinput] {
   xml {
     source => ["xmlinput"]
     store_xml => ["false"]
     xpath => ["/GroupPolicy/Control/TransactionId/text()", "transactionId"]
   }
   mutate {
     remove_field => ["xmlinput"]
   }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 11, 2017, 8:59pm UTC](https://discuss.elastic.co/t/logstash-parsing-string-xml/99907/2 "2017-09-11T20:59:58Z")

</div>

If you format the log example as preformatted text (like you did with the configuration) it'll be easier to help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2017, 9:00pm UTC](https://discuss.elastic.co/t/logstash-parsing-string-xml/99907/3 "2017-10-09T21:00:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.