# Parsing xml with 3 different variants of its content

**URL:** <https://discuss.elastic.co/t/parsing-xml-with-3-different-variants-of-its-content/207179>\
**Category:** Logstash\
**Created:** [November 8, 2019, 10:05pm UTC](https://discuss.elastic.co/t/parsing-xml-with-3-different-variants-of-its-content/207179 "2019-11-08T22:05:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![saif3r](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@saif3r](https://discuss.elastic.co/u/saif3r)\
**Post date:** [November 8, 2019, 10:05pm UTC](https://discuss.elastic.co/t/parsing-xml-with-3-different-variants-of-its-content/207179/1 "2019-11-08T22:05:53Z")

</div>

Hi,

One of our production machines outputs the log into an xml file. Said xml can have 3 different structures:

```
<useraction>
...
<error>
...
</error>
...
</useraction>

```

or

```
<useraction>
...
</useraction>

```

or

```
<error>
...
</error>

```

I'm wondering how my input and filter should look like to make sure that all three types are properly parsed as an event. Is this possible, or do i have to create three different inputs?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 8, 2019, 10:36pm UTC](https://discuss.elastic.co/t/parsing-xml-with-3-different-variants-of-its-content/207179/2 "2019-11-08T22:36:54Z")

</div>

You should be able to feed all three to the same xml filter.

---

<div class="post-metadata">

**Author:** ![saif3r](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@saif3r](https://discuss.elastic.co/u/saif3r)\
**Post date:** [November 8, 2019, 10:39pm UTC](https://discuss.elastic.co/t/parsing-xml-with-3-different-variants-of-its-content/207179/3 "2019-11-08T22:39:35Z")

</div>

Hi @Badger.  
But how my input {} should look like to make sure that the multiline file is properly split?

```
input {
	file {
		path => "/test/log*.xml"
		start_position => "beginning"
		codec => multiline {
			pattern => "<error>"
			what => "previous"
			negate => "true"
			}
		}
}

```

Right now it looks like above. It works fine only with second variant. Whenever occurs within the structure is not preserved.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 9, 2019, 2:26pm UTC](https://discuss.elastic.co/t/parsing-xml-with-3-different-variants-of-its-content/207179/4 "2019-11-09T14:26:14Z")

</div>

You can handle the last two using alternation

```
pattern => '</(useraction|error)>' negate => true what => "next"

```

However, I cannot think of any way to handle nested entries.

---

<div class="post-metadata">

**Author:** ![saif3r](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@saif3r](https://discuss.elastic.co/u/saif3r)\
**Post date:** [November 9, 2019, 8:11pm UTC](https://discuss.elastic.co/t/parsing-xml-with-3-different-variants-of-its-content/207179/5 "2019-11-09T20:11:38Z")

</div>

Thank you, I will give it a try!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2019, 8:11pm UTC](https://discuss.elastic.co/t/parsing-xml-with-3-different-variants-of-its-content/207179/6 "2019-12-07T20:11:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.