# Parsing logs with logstash

**URL:** <https://discuss.elastic.co/t/parsing-logs-with-logstash/352655>\
**Category:** Logstash\
**Created:** [February 6, 2024, 4:07pm UTC](https://discuss.elastic.co/t/parsing-logs-with-logstash/352655 "2024-02-06T16:07:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nejmeddine\_Saidane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nejmeddine_saidane/32/131489_2.png) [@Nejmeddine\_Saidane](https://discuss.elastic.co/u/Nejmeddine_Saidane)\
**Post date:** [February 6, 2024, 4:07pm UTC](https://discuss.elastic.co/t/parsing-logs-with-logstash/352655/1 "2024-02-06T16:07:39Z")

</div>

I have this log

```auto
{"data" => "<Event xmlns='link'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2024-02-06T16:01:08.593980800Z'/><EventRecordID>743861</EventRecordID><Correlation/><Execution ProcessID='644' ThreadID='9064'/><Channel>System</Channel><Computer>LPVSEIDW01.admsb3.log.intra.laposte.fr</Computer><Security/></System><EventData><Data Name='param1'>Service Configuration du réseau</Data><Data Name='param2'>en cours d’exécution</Data><Binary>4E0065007400530065007400750070005300760063002F0034000000</Binary></EventData><RenderingInfo Culture='fr-FR'><Message>Le service Service Configuration du réseau est entré dans l’état : en cours d’exécution.</Message><Level>Information</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Classique</Keyword></Keywords></RenderingInfo></Event>"}

```

I would delete this part of log

```auto
<Message>Le service Service Configuration du réseau est entré dans l’état : en cours d’exécution.</Message>

```

knowing that the value in the tag changes each time

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 6, 2024, 4:20pm UTC](https://discuss.elastic.co/t/parsing-logs-with-logstash/352655/2 "2024-02-06T16:20:51Z")

</div>

Perhaps

```
mutate { gsub => ["message", "<Message>[^<]*</Message>", "" ] }

```

---

<div class="post-metadata">

**Author:** ![Nejmeddine\_Saidane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nejmeddine_saidane/32/131489_2.png) [@Nejmeddine\_Saidane](https://discuss.elastic.co/u/Nejmeddine_Saidane)\
**Post date:** [February 6, 2024, 4:45pm UTC](https://discuss.elastic.co/t/parsing-logs-with-logstash/352655/3 "2024-02-06T16:45:21Z")

</div>

it does not work

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 6, 2024, 6:54pm UTC](https://discuss.elastic.co/t/parsing-logs-with-logstash/352655/4 "2024-02-06T18:54:36Z")

</div>

OK, so show us what an event looks like when you use `output { stdout { codec => rubydebug } }` so that we do not have to guess your event structure.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [February 6, 2024, 7:50pm UTC](https://discuss.elastic.co/t/parsing-logs-with-logstash/352655/5 "2024-02-06T19:50:46Z")

</div>

It does work. I would say you have to put `data` instead of `message` in gsub.

```auto
input {
  generator {
       message => "<Event xmlns='link'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2024-02-06T16:01:08.593980800Z'/><EventRecordID>743861</EventRecordID><Correlation/><Execution ProcessID='644' ThreadID='9064'/><Channel>System</Channel><Computer>LPVSEIDW01.admsb3.log.intra.laposte.fr</Computer><Security/></System><EventData><Data Name='param1'>Service Configuration du réseau</Data><Data Name='param2'>en cours d’exécution</Data><Binary>4E0065007400530065007400750070005300760063002F0034000000</Binary></EventData><RenderingInfo Culture='fr-FR'><Message>Le service Service Configuration du réseau est entré dans l’état : en cours d’exécution.</Message><Level>Information</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Classique</Keyword></Keywords></RenderingInfo></Event>"
	   count => 1
  }
}

filter {

  mutate { rename => { "message" => "data" } 
  gsub => ["data", "<Message>[^<]*</Message>", "" ] }
}

output {
 stdout { codec => rubydebug{} }
}

```

Result:

```auto
<Event
	xmlns='link'>
	<System>
		<Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/>
		<EventID Qualifiers='16384'>7036</EventID>
		<Version>0</Version>
		<Level>4</Level>
		<Task>0</Task>
		<Opcode>0</Opcode>
		<Keywords>0x8080000000000000</Keywords>
		<TimeCreated SystemTime='2024-02-06T16:01:08.593980800Z'/>
		<EventRecordID>743861</EventRecordID>
		<Correlation/>
		<Execution ProcessID='644' ThreadID='9064'/>
		<Channel>System</Channel>
		<Computer>LPVSEIDW01.admsb3.log.intra.laposte.fr</Computer>
		<Security/>
	</System>
	<EventData>
		<Data Name='param1'>Service Configuration du réseau</Data>
		<Data Name='param2'>en cours d?exécution</Data>
		<Binary>4E0065007400530065007400750070005300760063002F0034000000</Binary>
	</EventData>
	<RenderingInfo Culture='fr-FR'>
		<Level>Information</Level>
		<Task></Task>
		<Opcode></Opcode>
		<Channel></Channel>
		<Provider>Microsoft-Windows-Service Control Manager</Provider>
		<Keywords>
			<Keyword>Classique</Keyword>
		</Keywords>
	</RenderingInfo>
</Event>

```

---

<div class="post-metadata">

**Author:** ![Nejmeddine\_Saidane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nejmeddine_saidane/32/131489_2.png) [@Nejmeddine\_Saidane](https://discuss.elastic.co/u/Nejmeddine_Saidane)\
**Post date:** [February 7, 2024, 8:01am UTC](https://discuss.elastic.co/t/parsing-logs-with-logstash/352655/6 "2024-02-07T08:01:50Z")

</div>

```auto
 gsub => ["data", "<Message>[^<]*<\/Message>", ""]

```

it work, thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2024, 8:02am UTC](https://discuss.elastic.co/t/parsing-logs-with-logstash/352655/7 "2024-03-06T08:02:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.