# Need help to parse XML log in logstash

**URL:** <https://discuss.elastic.co/t/need-help-to-parse-xml-log-in-logstash/138973>\
**Category:** Logstash\
**Created:** [July 6, 2018, 6:15pm UTC](https://discuss.elastic.co/t/need-help-to-parse-xml-log-in-logstash/138973 "2018-07-06T18:15:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![iamlearner123](https://avatars.discourse-cdn.com/v4/letter/i/bcef8e/32.png) [@iamlearner123](https://discuss.elastic.co/u/iamlearner123)\
**Post date:** [July 6, 2018, 6:15pm UTC](https://discuss.elastic.co/t/need-help-to-parse-xml-log-in-logstash/138973/1 "2018-07-06T18:15:48Z")

</div>

I recently started learning ELK but having hard time in understanding on how to parse XML data. Below is the sample log data. Any help would be appreciated in helping to write logstash configuration.

```
<?xml version="1.0" encoding="UTF-8" ?>
<ExecutionLogModel>
<LogEvent level="INFO" time="2016-07-05T10:30:57Z" heapname="heap15" heaptype="Try/Catch" heaplabel="Eliminate the document with no user activity" heapextendedinfo="">
<Message>Executing Try/Catch heap with 1 document(s).</Message>
</LogEvent>
<LogEvent level="INFO" time="2016-07-04T10:30:57Z" heapname="heap8" heaptype="Message" heaplabel="" heapextendedinfo="">
<Message>heap executed successfully in 2 ms.</Message>
</LogEvent>
</ExecutionLogModel>
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 6, 2018, 8:56pm UTC](https://discuss.elastic.co/t/need-help-to-parse-xml-log-in-logstash/138973/2 "2018-07-06T20:56:57Z")

</div>

Have you looked into the xml filter? What do you want to extract from the XML document, i.e. what do you want Logstash to do?

---

<div class="post-metadata">

**Author:** ![iamlearner123](https://avatars.discourse-cdn.com/v4/letter/i/bcef8e/32.png) [@iamlearner123](https://discuss.elastic.co/u/iamlearner123)\
**Post date:** [July 9, 2018, 8:16pm UTC](https://discuss.elastic.co/t/need-help-to-parse-xml-log-in-logstash/138973/3 "2018-07-09T20:16:48Z")

</div>

I looked at XML filter but didn't understood it quit well. Currently, i am looking to parse the everything between the as one event.

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 9, 2018, 9:21pm UTC](https://discuss.elastic.co/t/need-help-to-parse-xml-log-in-logstash/138973/4 "2018-07-09T21:21:56Z")

</div>

If that's what you want to do it should be enough to set the xml filter's `source` option to the name of the field where the XML document is stored (probably `message`).

However, this assumes that the whole XML document has found itself into a field of a single Logstash event. You might need to make additional changes for that to happen, but with the few details about your configuration that you've given us I can't be more specific than that.

---

<div class="post-metadata">

**Author:** ![iamlearner123](https://avatars.discourse-cdn.com/v4/letter/i/bcef8e/32.png) [@iamlearner123](https://discuss.elastic.co/u/iamlearner123)\
**Post date:** [July 10, 2018, 10:30pm UTC](https://discuss.elastic.co/t/need-help-to-parse-xml-log-in-logstash/138973/5 "2018-07-10T22:30:32Z")

</div>

when i tried the below XML filter configuration for the above logs , logstash stopped listening on to the port 5044.

if [fields][logtype] == "process\_log" {  
xml {

```
source => "message"
target => "parsed"

split {
  field => "[parsed][logEvent]"
}

```

}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 11, 2018, 12:05pm UTC](https://discuss.elastic.co/t/need-help-to-parse-xml-log-in-logstash/138973/6 "2018-07-11T12:05:32Z")

</div>

You can't have the split filter _inside_ the xml filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2018, 12:05pm UTC](https://discuss.elastic.co/t/need-help-to-parse-xml-log-in-logstash/138973/7 "2018-08-08T12:05:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.