# Parsing failedRequest IIS

**URL:** <https://discuss.elastic.co/t/parsing-failedrequest-iis/106571>\
**Category:** Logstash\
**Created:** [November 6, 2017, 5:52pm UTC](https://discuss.elastic.co/t/parsing-failedrequest-iis/106571 "2017-11-06T17:52:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vinicius](https://avatars.discourse-cdn.com/v4/letter/v/bcef8e/32.png) [@vinicius](https://discuss.elastic.co/u/vinicius)\
**Post date:** [November 6, 2017, 5:52pm UTC](https://discuss.elastic.co/t/parsing-failedrequest-iis/106571/1 "2017-11-06T17:52:09Z")

</div>

Hello,

Anyone can help me parsing element "Buffer" with failed Request of IIS? I identifed 2 elements with same name (Buffer).  
If i'm run xpath (/failedRequest/tns:Event[26]/tns:EventData//tns:Data[@Name='Buffer']/text()) in [http://www.xpathtester.com/xpath](http://www.xpathtester.com/xpath) (remember put namespaces) work, but in Logstash not working.

Logstash config:  
[https://pastebin.com/hzbu2qNj](https://pastebin.com/hzbu2qNj)

XML FailedRequest  
[https://pastebin.com/jCWhhcJt](https://pastebin.com/jCWhhcJt)

Logstash Output  
{  
"RemoteAddress" =\> [  
[0] "192.168.0.1"  
],  
"Htmlerror" =\> [  
[0] "json=[]&vtesteariacao=Vini\n"  
],  
"offset" =\> 88796,  
"Headers" =\> [  
[0] "Connection: close\nContent-Length: 28\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nAccept: text/html, _/_; q=0.01\nAccept-Encoding: gzip, deflate, br\nAccept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3\nCookie: \_ga=GA1.3.1515350952.1506608472; PathStorage=; ASP.NET\_SessionId=rrdmtu3ftekpyon0gmgws1km; \_ga=GA1.4.1515350952.1506608472; \_gid=GA1.4.183052501.1508847309; \_\_atuvc=1%7C43; \_\_atuvs=59ef2f14b3f0b880000\nHost: [http://localhost:80/](http://localhost:80/) \nReferer: [http://localhost:80/testapp4.0/default.aspx\nUser-Agent:](http://localhost:80/testapp4.0/default.aspx%5CnUser-Agent:) Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\nX-Requested-With: XMLHttpRequest\n"  
],  
"appPoolId" =\> [  
[0] "Classic .NET AppPool"  
],  
"input\_type" =\> "log",  
"verb" =\> [  
[0] "POST"  
],  
"source" =\> "Path\FailedReqLogFiles\W3SVC36\fr000181.xml",  
"type" =\> "trace",  
"url" =\> [  
[0] "[http://localhost:80/testapp4.0/default.aspx](http://localhost:80/testapp4.0/default.aspx)"  
],  
"tags" =\> [  
[0] "beats\_input\_codec\_plain\_applied"  
],  
"@timestamp" =\> 2017-11-06T17:36:25.595Z,  
"@version" =\> "1",  
"beat" =\> {  
"name" =\> "ServerName",  
"hostname" =\> "ServerName",  
"version" =\> "5.6.3"  
},  
"host" =\> "ServerName",  
"statusCode" =\> [  
[0] "500"  
]  
}

---

<div class="post-metadata">

**Author:** ![vinicius](https://avatars.discourse-cdn.com/v4/letter/v/bcef8e/32.png) [@vinicius](https://discuss.elastic.co/u/vinicius)\
**Post date:** [November 7, 2017, 1:01pm UTC](https://discuss.elastic.co/t/parsing-failedrequest-iis/106571/2 "2017-11-07T13:01:16Z")

</div>

Any idea how parsing ambiguous name(Buffer)?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2017, 1:01pm UTC](https://discuss.elastic.co/t/parsing-failedrequest-iis/106571/3 "2017-12-05T13:01:30Z")

</div>

Closed on December 5, 2017, 1:01pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.