# Parsing Windows Event Logs with nested xml
**URL:** https://discuss.elastic.co/t/parsing-windows-event-logs-with-nested-xml/172500
**Category:** Logstash
**Created:** [March 15, 2019, 9:45am UTC](https://discuss.elastic.co/t/parsing-windows-event-logs-with-nested-xml/172500 "2019-03-15T09:45:23Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@jmohar](https://discuss.elastic.co/u/jmohar)
#### Post date: [March 15, 2019, 9:45am UTC](https://discuss.elastic.co/t/parsing-windows-event-logs-with-nested-xml/172500/1 "2019-03-15T09:45:23Z")
Dear community.
After spending more than a week with logstash and winlogbeat to parse Windows\_Event\_Logs..but have no clue how to parse the nested xml in the security windows eventlogs (vistaeventlogs).
Using Logstash 6.6.1
I learned that Winlogbeat is not able to parse the nested xml in this event\_log . So we ship the event\_log to logstash, which contain this message\_field:
`message" => "The Federation Service issued a valid token. See XML for details. \n\nActivity ID: 04ca7383-37f9-4d06-bb5f-0080010000f4 \n\nAdditional Data \nXML: \n\n AppToken\n Success\n None\n N/A\n \n \n https://gym-subs.ro.r4.madm.net/saml/module.php/saml/sp/metadata.php/gym-subs-sp\n AD AUTHORITY\n testuser\n \n \n http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/windows\n false\n N/A\n false\n N/A\n false\n false\n TokenUnbound\n \n \n N/A\n N/A\n \n \n http://adfs4int.fds.metro.info/adfs/services/trust\n SAMLP\n Intranet\n 10.16.234.42\n \n N/A\n N/A\n N/A\n Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0\n /adfs/ls/\n \n \n"`
Using the xml filter this message is parsed to "xml.ContextComponents.Component"
Unfortunately i was not able to "xpath" necessary attributes from "messages"...also "grok" this message is more or less frustrating 🙂
Searching the Community i found a hint to split the message field after running this through the xml filter...this seems to work...but unfortunately creates 3 additional events plus the original event.
Is there a way to aggregate this 4 events back to one , again ?
Out logstash.config:
```
input {
beats {
port => 5044
}
}
filter {
xml {
source => "message"
store_xml => "true"
target => "xml"
force_array => false
}
split { field => "[xml][ContextComponents][Component]" }
}
output {
stdout { codec => rubydebug }
}
```
Do you have any hints, what is the right way to parse this "message" field with nested xml ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 16, 2019, 2:34pm UTC](https://discuss.elastic.co/t/parsing-windows-event-logs-with-nested-xml/172500/2 "2019-03-16T14:34:33Z")
> [@jmohar](#):
>
> Searching the Community i found a hint to split the message field after running this through the xml filter...this seems to work...but unfortunately creates 3 additional events plus the original event.
> Is there a way to aggregate this 4 events back to one , again ?
The entire point of a split filter is to split one event into more than one. If you want to keep one event as one event then do not use a split filter.
The following xpath expressions will pull items out of the Component entries.
```
xpath => {
"/AuditBase/ContextComponents/Component/ClaimsProvider/text()" => "ClaimsProvider"
"/AuditBase/ContextComponents/Component/PrimaryAuth/text()" => "PrimaryAuth"
"/AuditBase/ContextComponents/Component/IpAddress/text()" => "IpAddress"
}
```
If that does not help then please explain what you are trying to do.
---
### Author:  [@jmohar](https://discuss.elastic.co/u/jmohar)
#### Post date: [March 18, 2019, 6:43am UTC](https://discuss.elastic.co/t/parsing-windows-event-logs-with-nested-xml/172500/3 "2019-03-18T06:43:57Z")
> [@jmohar](#):
>
> UserId
Thank you for the quick reply! I already "played around" with xpath...but regardless what path setting i insert...the xpath field are always empty:
I tested various xpath settings...the fields are always empty in stndout and kibana
```
filter {
xml {
source => "message"
store_xml => "false"
force_array => false
xpath => {
"/AuditBase/AuditType/text()" => "AuditType"
"/AuditBase/AuditResult/text()" => "AuditResult"
"/AuditBase/ContextComponents/Component/RelyingParty" => "RelyingParty"
"/AuditBase/ContextComponents/Component/ClaimsProvider/text()" => "ClaimsProvider"
"/AuditBase/ContextComponents/Component/UserId/text()" => "UserId"
}
}
```
But the fields are always empty:
STND shows this:
Mar 18 09:06:57 SSP30MYSRV01394 logstash[16395]: "RelyingParty" =\> ,
Mar 18 09:06:57 SSP30MYSRV01394 logstash[16395]: "ClaimsProvider" =\> ,
Do you have any further hints for me ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 18, 2019, 1:01pm UTC](https://discuss.elastic.co/t/parsing-windows-event-logs-with-nested-xml/172500/4 "2019-03-18T13:01:11Z")
Are you removing the prefix before you parse the XML?
```
mutate { gsub => ["message", "(?m).*XML: ", ""] }
```
I was surprised to find that the xml filter skips the prefix, but none of the xpath entries work. Once you remove the prefix xpath starts working.
---
### Author:  [@jmohar](https://discuss.elastic.co/u/jmohar)
#### Post date: [March 18, 2019, 1:18pm UTC](https://discuss.elastic.co/t/parsing-windows-event-logs-with-nested-xml/172500/5 "2019-03-18T13:18:09Z")
Beside the "message" field... also "event\_data.param1" and "event\_data.param2" was shipped by winlogbeat. "event\_data.param2" contain pure xml data. "message" is somekind of "whatever"...strings with embedded xml. Nothing logstash can work with out of the box. Parsing the source "event\_data.param2" does the trick and xpath was able to find the attributes. Thank you for the hint !
This does the trick for us:
```
filter {
mutate {
add_field => {"Activity_ID" => "%{[event_data][param1]}"}
}
xml {
source => "[event_data][param2]"
store_xml => "false"
force_array => false
xpath => {
"/AuditBase/AuditType/text()" => "AuditType"
"/AuditBase/AuditResult/text()" => "AuditResult"
"/AuditBase/FailureType/text()" => "FailureType"
"/AuditBase/ErrorCode/text()" => "ErrorCode"
"/AuditBase/ContextComponents/Component/RelyingParty/text()" => "RelyingParty"
"/AuditBase/ContextComponents/Component/ClaimsProvider/text()" => "ClaimsProvider"
"/AuditBase/ContextComponents/Component/UserId/text()" => "UserId"
"/AuditBase/ContextComponents/Component/OAuthClientId/text()" => "OAuthClientId"
"/AuditBase/ContextComponents/Component/OAuthGrant/text()" => "OAuthGrant"
"/AuditBase/ContextComponents/Component/Server/text()" => "Server"
"/AuditBase/ContextComponents/Component/AuthProtocol/text()" => "AuthProtocol"
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 15, 2019, 1:18pm UTC](https://discuss.elastic.co/t/parsing-windows-event-logs-with-nested-xml/172500/6 "2019-04-15T13:18:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.