# Nested XML from filebeat to logstash issue

**URL:** <https://discuss.elastic.co/t/nested-xml-from-filebeat-to-logstash-issue/184063>\
**Category:** Logstash\
**Created:** [June 3, 2019, 10:07pm UTC](https://discuss.elastic.co/t/nested-xml-from-filebeat-to-logstash-issue/184063 "2019-06-03T22:07:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kishorerv93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorerv93/32/47194_2.png) [@kishorerv93](https://discuss.elastic.co/u/kishorerv93)\
**Post date:** [June 3, 2019, 10:07pm UTC](https://discuss.elastic.co/t/nested-xml-from-filebeat-to-logstash-issue/184063/1 "2019-06-03T22:07:44Z")

</div>

Hi,

Below is my Nested XML file.

```auto
<?xml-stylesheet alternate="yes" href="file://c:/drive/bin/event_log.xsl" type="text/xsl"?>
<EventLog SetMinutes="800" Id="8000" Process="Player.exe">
<Clock ClockId="CLk-21e21412414=4-1341341414141"/>
<Entry serial_no="0" mcycle="2132424124-4141" Thread="player" ThreadId="tester" Seconds="11231243241.354123" Severity="info" >Local player details - Receievd metrics
player has reached 1000 level and need to get an xp
player has reached 100 level and need to get an xp
player has reached to 70 level and need to get an xp
player has reached 1000 level and need to get an xp
player has reached 100 level and need to get an xp
player has reached to 70 level and need to get an xp
player has reached 400 level and need to get an xp
player has reached 100 level and need to get an xp
player has reached to 30 level and need to get an xp
player has reached 103 level and need to get an xp
player has reached 130 level and need to get an xp
player has reached to 70 level and need to get an xp
player has reached 1000 level and need to get an xp
player has reached 100 level and need to get an xp
player has reached to 70 level and need to get an xp
player has reached 3300 level and need to get an xp
player has reached 100 level and need to get an xp
player has reached to 70 level and need to get an xp
player has reached 1300 level and need to get an xp
player has reached 103 level and need to get an xp
player has reached 1000 level and need to get an xp
player has reached 100 level and need to get an xp
player has reached to 70 level and need to get an xp
player has reached 1000 level and need to get an xp
player has reached 100 level and need to get an xp
player has reached to 70 level and need to get an xp
player has reached 400 level and need to get an xp
player has reached 100 level and need to get an xp
player has reached to 30 level and need to get an xp
player has reached 103 level and need to get an xp
player has reached 130 level and need to get an xp
player has reached to 70 level and need to get an xp
player has reached 1000 level and need to get an xp
player has reached 100 level and need to get an xp
player has reached to 70 level and need to get an xp
player has reached 3300 level and need to get an xp
player has reached 100 level and need to get an xp
player has reached to 70 level and need to get an xp
player has reached 1300 level and need to get an xp
player has reached 103 level and need to get an xp
player has reached to 733 level and need to get an xp
</Entry> 
</Eventlog>

```

My filebeat.yml multiline config.

```auto
multiline:
    pattern: "^<Entry"
    negate: true
    match: after

```

Logstash.conf

```auto
 xml {
    source => "message"
    target => "doc"
    store_xml => true
    force_array => true
    xpath => ["/EventLog/Entry[@name='Severity']/@Value", "Severity",
              "/EventLog/Entry[@name='SysDate']/@Value", "SysDate",
              "/EventLog/Entry[@name='SysTime']/@Value", "SysTime",
              "/EventLog/Entry[@name='SysDateTime']/@Value", "SysDateTime",
              "/EventLog/Entry[@name='Thread']/@Value", "Thread",
              "/EventLog/Entry[@name='Category']/@Value", "Category",
              "/Eventlog/Entry/text()", "details"	
              ]	

```

Multiline is working when i'm inputing as a file in logstash. Bu tit is not working when im using filebeat .

Can anyone help me out

Thanks

---

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [June 4, 2019, 9:10am UTC](https://discuss.elastic.co/t/nested-xml-from-filebeat-to-logstash-issue/184063/2 "2019-06-04T09:10:27Z")

</div>

What is the codec that you are using in the input from filebeat?

---

<div class="post-metadata">

**Author:** ![kishorerv93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorerv93/32/47194_2.png) [@kishorerv93](https://discuss.elastic.co/u/kishorerv93)\
**Post date:** [June 4, 2019, 11:09am UTC](https://discuss.elastic.co/t/nested-xml-from-filebeat-to-logstash-issue/184063/3 "2019-06-04T11:09:01Z")

</div>

I’m using codec =\> json

Since codec =\> multiline doesn’t work with input beats anymore.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 2, 2019, 11:09am UTC](https://discuss.elastic.co/t/nested-xml-from-filebeat-to-logstash-issue/184063/4 "2019-07-02T11:09:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.