# Parsing Alienvault xml logs

**URL:** https://discuss.elastic.co/t/parsing-alienvault-xml-logs/122605
**Category:** Logstash
**Created:** [March 5, 2018, 10:21pm UTC](https://discuss.elastic.co/t/parsing-alienvault-xml-logs/122605 "2018-03-05T22:21:23Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![jgwentworth](https://avatars.discourse-cdn.com/v4/letter/j/97f17d/32.png) [@jgwentworth](https://discuss.elastic.co/u/jgwentworth)
#### Post date: [March 5, 2018, 10:21pm UTC](https://discuss.elastic.co/t/parsing-alienvault-xml-logs/122605/1 "2018-03-05T22:21:23Z")

</div>

I'm looking to parse out the specific fields indicated in each entry id tag.

```
<?xml version='1.0' encoding='ISO-8859-1' ?><log>
<sign type='' digest='' />
<entry id='' v='' fdate='' date='' plugin_id='' sensor='' src_ip='' dst_ip='' src_port='' dst_port='' tzone='' datalen='' data='' plugin_sid='' proto='' ctx='' src_host='' dst_host='' src_net='' dst_net='' username='' userdata1='' userdata2='' userdata3='' userdata4='' userdata5='' userdata9='' idm_host_src='' idm_host_dst='' idm_mac_src='' idm_mac_dst='' device=''/>

```

Any examples of what you would refer to in the xml filter to identify available fields would be extremely helpful.

---

<div class="post-metadata">

### Author: ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [March 6, 2018, 3:11am UTC](https://discuss.elastic.co/t/parsing-alienvault-xml-logs/122605/2 "2018-03-06T03:11:06Z")

</div>

Interesting, it's all one large XML element with lots of attributes? In any case, the XML filter with xpath should probably get you going.

[This is a good place](https://www.w3schools.com/XML/xml_xpath.asp) to start if you're unfamiliar with XPath.

Given that this doesn't conform to your logs format, here's a simple example

**Example XML**

> ```
> <Top>
> <TopData>1</TopData>
> <Middle>
> <Bottom>
> <BottomData>20</BottomData>
> </Bottom>
> </Middle>
> </Top>
> 
> ```

**Example Filter**

> ```
> filter {
> xml {
> xpath => [
> "top/topdata/text()", "Top Data",
> "top/middle/bottom/bottomdata/text()", "Bottom Data"
> ]
> }
> }
> 
> ```

**Resulting Fields**  
Top Data: 1  
Bottom Data: 20

---

<div class="post-metadata">

### Author: ![jgwentworth](https://avatars.discourse-cdn.com/v4/letter/j/97f17d/32.png) [@jgwentworth](https://discuss.elastic.co/u/jgwentworth)
#### Post date: [March 6, 2018, 12:43pm UTC](https://discuss.elastic.co/t/parsing-alienvault-xml-logs/122605/3 "2018-03-06T12:43:20Z")

</div>

Thanks so much @wwalker

This is exactly what I was looking for.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 3, 2018, 12:43pm UTC](https://discuss.elastic.co/t/parsing-alienvault-xml-logs/122605/4 "2018-04-03T12:43:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.