# Logstash xml parsing

**URL:** <https://discuss.elastic.co/t/logstash-xml-parsing/77836>\
**Category:** Logstash\
**Created:** [March 8, 2017, 2:42pm UTC](https://discuss.elastic.co/t/logstash-xml-parsing/77836 "2017-03-08T14:42:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![WildCard](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@WildCard](https://discuss.elastic.co/u/WildCard)\
**Post date:** [March 8, 2017, 2:42pm UTC](https://discuss.elastic.co/t/logstash-xml-parsing/77836/1 "2017-03-08T14:42:06Z")

</div>

Hi guys,

I have a xml parsing problem...  
this is a very smal part of the xml (the xml's are about 500MB and a lot of different nested fields:

```
<?xml version="1.0" encoding="utf-8"?>
<project id="0001" name="TEST_CASE">
  <Extractions>
    <extractionInfo id="9" name="PHONE"/>
    <extractionInfo id="10" name="SIM"/>
  </Extractions>
  <metadata section="Extraction Data">
    <item name="DeviceInfo" sourceExtraction="10"><![CDATA[THIS_I_NEED_1]]></item>
  </metadata>
  <metadata section="Device Info">
    <item id="683c9ea2a37f" name="IMEI" sourceExtraction="9"><![CDATA[THIS_I_NEED_2]]></item>
  </metadata>
</project>

```

I was trying to retrieve the " **THIS\_I\_NEED**" strings  
But I can't seem to get it to work.  
this is my xml filter:

```
input {
	file {
		type => XML_Report
		start_position => "beginning"
		sincedb_path => "/dev/null"
		path => "/DATA/*/report.xml"
	}
}
filter {
	xml {
		store_xml => "false"
		source => "message"
		xpath =>[
			"/project/metadata/[@Device Info=@section]/item[@name=@IMEI]/text()","IMEI"
		]
	}
}
output {
	elasticsearch {
	host => ["localhost:9200"]
	index => "logstash-%{[type]}"
	}
}

```

Any ideas? Because I've tried many combinations, but nothing seems to work...  
thanks in advance!

---

<div class="post-metadata">

**Author:** ![RodrigoMontoro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rodrigomontoro/32/16203_2.png) [@RodrigoMontoro](https://discuss.elastic.co/u/RodrigoMontoro)\
**Post date:** [March 8, 2017, 11:26pm UTC](https://discuss.elastic.co/t/logstash-xml-parsing/77836/2 "2017-03-08T23:26:33Z")

</div>

You probably need to use multine before xml filter. Something like:

multiline {  
pattern =\> ""  
negate =\> "true"   
what =\> "next"  
}

[https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html)

Anyway if you post which errors are you getting would be easier to help.

Hope it helps.

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2017, 11:26pm UTC](https://discuss.elastic.co/t/logstash-xml-parsing/77836/3 "2017-04-05T23:26:36Z")

</div>

Closed on April 5, 2017, 11:26pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.