# Logstash XML file with multiple patterns

**URL:** <https://discuss.elastic.co/t/logstash-xml-file-with-multiple-patterns/105914>\
**Category:** Logstash\
**Created:** [October 31, 2017, 3:46pm UTC](https://discuss.elastic.co/t/logstash-xml-file-with-multiple-patterns/105914 "2017-10-31T15:46:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![moriol](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@moriol](https://discuss.elastic.co/u/moriol)\
**Post date:** [October 31, 2017, 3:46pm UTC](https://discuss.elastic.co/t/logstash-xml-file-with-multiple-patterns/105914/1 "2017-10-31T15:46:51Z")

</div>

I have an xml file as an input in Logstash and ElasticSeach as output.  
My xml has multiple patterns, where my xml file looks like:  
\< Header\>  
\< Value1\>xyz\< /Value1\>  
\< FileName\>name\< /FileName\>  
\< System\>test\< /System\>  
\< Header\>  
\< parameter value="xyz" system="xyz" ShortDescription="xyz"\>  
\< LongDescription\>xyz \< /LongDescription\>  
\< Length\>xyz\< /Length\>  
\< /parameter\>  
\< differentparameter value="xyz" system="xyz" ShortDescription="xyz"\>  
\< LongDescription\>xyz \< /LongDescription\>  
\< Length\>xyz\< /Length\>  
\< /differentparameter\>

In my input I am trying:  
codec =\> multiline {  
pattern =\> "._\<parameter._"  
# negate =\> true  
# what =\> "previous"  
#}

When I use this, all my values in show up correctly, the others dont.  
Is there a way to specify multiple patterns for xml file, for example:  
pattern =\> "._\<Header._"  
&  
pattern =\> "._\<parameter._"  
&  
pattern =\> "._\<differentparameter._"

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 31, 2017, 8:24pm UTC](https://discuss.elastic.co/t/logstash-xml-file-with-multiple-patterns/105914/2 "2017-10-31T20:24:26Z")

</div>

Format the XML as preformatted text so we can see what it looks like. Always do the same thing with configuration snippets and logs.

---

<div class="post-metadata">

**Author:** ![moriol](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@moriol](https://discuss.elastic.co/u/moriol)\
**Post date:** [November 2, 2017, 8:39am UTC](https://discuss.elastic.co/t/logstash-xml-file-with-multiple-patterns/105914/3 "2017-11-02T08:39:19Z")

</div>

Ok I changed it now, hope its clearer.  
Basically I am trying to get Logstash to recognize that there are multiple patterns for my xml and specify them in the pattern configuration in my input.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 2, 2017, 10:37am UTC](https://discuss.elastic.co/t/logstash-xml-file-with-multiple-patterns/105914/4 "2017-11-02T10:37:49Z")

</div>

```
<(Header|parameter|differentparameter)
```

---

<div class="post-metadata">

**Author:** ![moriol](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@moriol](https://discuss.elastic.co/u/moriol)\
**Post date:** [November 2, 2017, 11:01am UTC](https://discuss.elastic.co/t/logstash-xml-file-with-multiple-patterns/105914/5 "2017-11-02T11:01:17Z")

</div>

That does the trick, thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 30, 2017, 11:01am UTC](https://discuss.elastic.co/t/logstash-xml-file-with-multiple-patterns/105914/6 "2017-11-30T11:01:30Z")

</div>

Closed on November 30, 2017, 11:01am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.