# Parse multiline xml config file into one event, not many

**URL:** https://discuss.elastic.co/t/parse-multiline-xml-config-file-into-one-event-not-many/104146
**Category:** Logstash
**Created:** [October 16, 2017, 9:30pm UTC](https://discuss.elastic.co/t/parse-multiline-xml-config-file-into-one-event-not-many/104146 "2017-10-16T21:30:10Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![JSkier](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@JSkier](https://discuss.elastic.co/u/JSkier)
#### Post date: [October 16, 2017, 9:30pm UTC](https://discuss.elastic.co/t/parse-multiline-xml-config-file-into-one-event-not-many/104146/1 "2017-10-16T21:30:10Z")

</div>

Hi,

I'm monitoring a configuration xml file for changes using filebeat, and sending it over to logstash. I would like to take the key value pair into one event in elasticsearch. It seems to do fine parsing the XML line by line (creating an event for each line, with parsed name and parsed value), but I'd like to have one event with all key value pairs recognized per monitored config file.

Filebeat is sending only the lines I want over. They look like this (notice the white space in front):

```
 <userConfig name="User" value="wookie"/>
 <userConfig name="Lastlogon" value="15446454645"/>

```

I've played around with the multiline codec in logstash which will put one file = one event, however it fails to parse the xml.

XML filter I'm using (have tried targeting doc and parsed for target). This works as long as I don't use the multiline input codec:

```
filter {
  xml {
    source => "message"
    #force_array => "true"
    target => "parsed"
    remove_namespaces => true
    store_xml => true
    force_array => true
  }
}

```

Thanks for any help,

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 13, 2017, 9:30pm UTC](https://discuss.elastic.co/t/parse-multiline-xml-config-file-into-one-event-not-many/104146/2 "2017-11-13T21:30:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.