# Logstash xml input plugin - parsing log4net:event

**URL:** https://discuss.elastic.co/t/logstash-xml-input-plugin-parsing-log4net-event/349817
**Category:** Logstash
**Created:** [December 21, 2023, 6:27pm UTC](https://discuss.elastic.co/t/logstash-xml-input-plugin-parsing-log4net-event/349817 "2023-12-21T18:27:40Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![pumiki](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@pumiki](https://discuss.elastic.co/u/pumiki)
#### Post date: [December 21, 2023, 6:27pm UTC](https://discuss.elastic.co/t/logstash-xml-input-plugin-parsing-log4net-event/349817/1 "2023-12-21T18:27:40Z")

</div>

Hello,  
log4net generates xml file.  
every event is stored in xml element called log4net:event.

The issue is that logstash cant parse the element with the ":" in it.  
any idea ?

The xml

```auto

<log4net:event><log4netmessage>Message1</log4netmessage></log4net:event>
<log4net:event><log4netmessage>Message2</log4netmessage></log4net:event>

```

logstash config

```auto

input
{
	file
  	{
		path => "c:/dockers/logstash/logstash-8.11.2/config/demo006b_input_file.txt"
    		sincedb_path => "NUL"
    		start_position => "beginning"
  	}
}
filter 
{
        xml 
	{
		remove_namespaces => true
        	source => "message"
		store_xml => false		
		force_array => "false"
		xpath => ["/log4netevent/log4netmessage/text()", "LogMessage"]
  	}
}
output
{
	#stdout
   	stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 21, 2023, 6:46pm UTC](https://discuss.elastic.co/t/logstash-xml-input-plugin-parsing-log4net-event/349817/2 "2023-12-21T18:46:43Z")

</div>

> [@pumiki](#):
>
> The issue is that logstash cant parse the element with the ":" in it.  
> any idea ?

If the XML uses a namespace then it needs to define it. So the XML should be

```
<log4net:event xmlns:log4net="http://www.example.com"><log4netmessage>Message1</log4netmessage></log4net:event>

```

and then you could parse it using

```
    xml {
        remove_namespaces => true
        source => "message"
        store_xml => false
        force_array => false
        xpath => ["/event/log4netmessage/text()", "LogMessage"]
    }

```

---

<div class="post-metadata">

### Author: ![pumiki](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@pumiki](https://discuss.elastic.co/u/pumiki)
#### Post date: [December 21, 2023, 7:36pm UTC](https://discuss.elastic.co/t/logstash-xml-input-plugin-parsing-log4net-event/349817/3 "2023-12-21T19:36:36Z")

</div>

I am sorry.  
It is still not clear to me.

I am not working with schema.

do you suggest that if i will work with schema,  
then logstash will know how to handle elements  
that contains special characters in the element name ?  
(eg: log4net:event)

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 21, 2023, 8:40pm UTC](https://discuss.elastic.co/t/logstash-xml-input-plugin-parsing-log4net-event/349817/4 "2023-12-21T20:40:41Z")

</div>

Element names cannot contain colon unless it is used to separate the namespace from the element name. That may not have been true in the earliest versions of XML but I think you will find that modern XML processing software enforces it.

---

<div class="post-metadata">

### Author: ![pumiki](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@pumiki](https://discuss.elastic.co/u/pumiki)
#### Post date: [December 21, 2023, 10:04pm UTC](https://discuss.elastic.co/t/logstash-xml-input-plugin-parsing-log4net-event/349817/5 "2023-12-21T22:04:50Z")

</div>

I used the remove\_namespaces and it sees to work now .  
see below.  
Thank you for your kind help, Badger .

xml

```auto
<log4net:event><log4net:message>Message1</log4net:message></log4net:event>
<log4net:event><log4net:message>Message2</log4net:message></log4net:event>
<log4net:event><log4net:message>Message3</log4net:message></log4net:event>
<log4net:event><log4net:message>Message4</log4net:message></log4net:event>

```

configuration  
Note: Xpath queries are using element names without namespace.

```auto

input
{
	#file input plugin. 
	#Note: pay attention to the slash direction in path.
  	file
  	{
		path => "c:/dockers/logstash/logstash-8.11.2/config/demo006b_input_file.txt"
    		sincedb_path => "NUL"
    		start_position => "beginning"
	}
}
filter 
{
	xml 
	{
		source => "message"	
		remove_namespaces => true
		force_array => "false"
		xpath => 
		{
			 "/event/message/text()"	=> "LogMessage" 
		}
		store_xml => false
  	}
}
output
{
	#stdout
   	stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 18, 2024, 10:05pm UTC](https://discuss.elastic.co/t/logstash-xml-input-plugin-parsing-log4net-event/349817/6 "2024-01-18T22:05:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.