# Need help with parsing multiline XML file

**URL:** <https://discuss.elastic.co/t/need-help-with-parsing-multiline-xml-file/64599>\
**Category:** Logstash\
**Created:** [November 1, 2016, 6:08pm UTC](https://discuss.elastic.co/t/need-help-with-parsing-multiline-xml-file/64599 "2016-11-01T18:08:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pikuchan](https://avatars.discourse-cdn.com/v4/letter/p/e68b1a/32.png) [@pikuchan](https://discuss.elastic.co/u/pikuchan)\
**Post date:** [November 1, 2016, 6:08pm UTC](https://discuss.elastic.co/t/need-help-with-parsing-multiline-xml-file/64599/1 "2016-11-01T18:08:40Z")

</div>

Hey everyone,  
I am new to logstash and am trying to figure out how to get an xml file to load properly and I just can't seem to get it. I'm sure there's plenty of user error here, but I've done a ton of trial and error.

Here's what I got right now.  
Test xml file

> ```
> <?xml version="1.0"?>
> <book id="bk101">
> <author>Gambardella, Matthew</author>
> <title>XML Developer's Guide</title>
> <genre>Computer</genre>
> <price>44.95</price>
> <publish_date>2000-10-01</publish_date>
> <description>An in-depth look at creating applications 
> with XML.</description>
> </book>
> <book id="bk102">
> <author>Ralls, Kim</author>
> <title>Midnight Rain</title>
> <genre>Fantasy</genre>
> <price>5.95</price>
> <publish_date>2000-12-16</publish_date>
> <description>A former architect battles corporate zombies, 
> an evil sorceress, and her own childhood to become queen 
> of the world.</description>
> </book>
> 
> ```

And here is my config file

> ```
> input {  
> file 
> {
> path => "/var/lib/files/books.xml"
> start_position => "beginning"
> type => "book"
> codec => multiline {
> ##pattern => "<book*" 
> pattern => "^<book .*\>"
> negate => "true"
> what => "previous"
> }
> }
> }
> 
> ```

```
filter 
{
  xml {
      store_xml => "false"
      source => "book"
      ##target => "parsed"
      xpath => [ 
        "/book/author", "Author",
        "/book/title", "Title"
      ]
  }
}

output {
    stdout 
    {
        codec => rubydebug
    }
    
    elasticsearch {
        hosts => "elasticsearch:9200"
    }
}

```

Any help would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 1, 2016, 9:22pm UTC](https://discuss.elastic.co/t/need-help-with-parsing-multiline-xml-file/64599/2 "2016-11-01T21:22:23Z")

</div>

What _does_ happen? Is Logstash producing any events at all?

---

<div class="post-metadata">

**Author:** ![pikuchan](https://avatars.discourse-cdn.com/v4/letter/p/e68b1a/32.png) [@pikuchan](https://discuss.elastic.co/u/pikuchan)\
**Post date:** [November 1, 2016, 11:47pm UTC](https://discuss.elastic.co/t/need-help-with-parsing-multiline-xml-file/64599/3 "2016-11-01T23:47:47Z")

</div>

I am getting logs currently, but everything is crammed into the message event. This is what one of my logs looks like.

> {  
> "\_index": "logstash-2016.11.01",  
> "\_type": "book",  
> "\_id": "AVgh15UmZqE3X8UXKZit",  
> "\_score": 1,  
> "\_source": {  
> "path": "/var/lib/files/books2.xml",  
> "@timestamp": "2016-11-01T21:42:05.619Z",  
> "@version": "1",  
> "host": "f0cfdd2f4d81",  
> "message": "\<book category="WEB"\>\r\n \<title lang="en"\>Learning XML\r\n Erik T. Ray\r\n 2003\r\n 39.95\r\n\r\n\r",  
> "type": "book",  
> "tags": [  
> "multiline"  
> ]  
> }

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 2, 2016, 5:01am UTC](https://discuss.elastic.co/t/need-help-with-parsing-multiline-xml-file/64599/4 "2016-11-02T05:01:52Z")

</div>

> "message": "\r\n Learning XML\r\n Erik T. Ray\r\n 2003\r\n 39.95\r\n\r\n\r",

Is this _really_ what it looks like? No XML tags? Always make sure to format configuration files and log file snippets as preformatted text when posting here. And use the preview pane to make sure what you're posting looks okay.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:31am UTC](https://discuss.elastic.co/t/need-help-with-parsing-multiline-xml-file/64599/5 "2017-07-06T04:31:37Z")

</div>