# Question about develop an integration for XML input via TCP

**URL:** <https://discuss.elastic.co/t/question-about-develop-an-integration-for-xml-input-via-tcp/326670>\
**Category:** Elastic Agent\
**Tags:** beats-development, filebeat, integrations\
**Created:** [February 28, 2023, 9:34am UTC](https://discuss.elastic.co/t/question-about-develop-an-integration-for-xml-input-via-tcp/326670 "2023-02-28T09:34:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sebastian\_Huettersen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastian_huettersen/32/117296_2.png) [@Sebastian\_Huettersen](https://discuss.elastic.co/u/Sebastian_Huettersen)\
**Post date:** [February 28, 2023, 9:34am UTC](https://discuss.elastic.co/t/question-about-develop-an-integration-for-xml-input-via-tcp/326670/1 "2023-02-28T09:34:24Z")

</div>

I am currently trying to develop an integration that takes reports from an appliance and then indexes them in elastic.

The appliance sends these XML reports via TCP.

Currently, I have the problem that I can't get the `decode_xml` processor to decode the xml.

Here I first tried to send an example report using observability/stream log, but characters are escaped. Next I tried to use observability/stream pcap.

For this I used `tcpdump` to create a pcap of XML report from the appliance. After that I modified the PCAP so that there are only packets where the XML report is transferred.

Now the XML decoder works, but the message part is split to several documents, which throws an unexpected EOF error.

The question now is, did I use `observability/stream pcap` wrong or should I not use it at all.

Or do I need a parser multiline here. The multiline parser I tried does not work:

```
parsers:
- multiline:
    type: pattern
    pattern: '<\/report>'
    negate: true
    match: before

```

The XML has the following structure:

```
<report id="9681bea7-6512-4f50-8879-e05a84c68a58">
  <gmp>
      <version>22.4</version>
  </gmp>
      ... 
  <errors>
      <count>0</count>
  </errors>
<report_format></report_format>
</report>

```

Regards

Sebastian

---

<div class="post-metadata">

**Author:** ![Sebastian\_Huettersen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastian_huettersen/32/117296_2.png) [@Sebastian\_Huettersen](https://discuss.elastic.co/u/Sebastian_Huettersen)\
**Post date:** [March 3, 2023, 7:52am UTC](https://discuss.elastic.co/t/question-about-develop-an-integration-for-xml-input-via-tcp/326670/2 "2023-03-03T07:52:44Z")

</div>

After a bit of debugging I found the problem the xml file contains \n therfore I need a diffrent line\_delimite.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 31, 2023, 7:53am UTC](https://discuss.elastic.co/t/question-about-develop-an-integration-for-xml-input-via-tcp/326670/3 "2023-03-31T07:53:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.