# Remove head and tail for xml

**URL:** <https://discuss.elastic.co/t/remove-head-and-tail-for-xml/169331>\
**Category:** Logstash\
**Created:** [February 21, 2019, 6:04am UTC](https://discuss.elastic.co/t/remove-head-and-tail-for-xml/169331 "2019-02-21T06:04:52Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [February 21, 2019, 6:04am UTC](https://discuss.elastic.co/t/remove-head-and-tail-for-xml/169331/1 "2019-02-21T06:04:52Z")

</div>

I am trying to break one xml file into multiple event.  
I use \<PMSetup as pattern to splite  
pattern =\> "\<PMSetup"  
How can I remove the beginning 2 lines (\<?xml version="1.0"?\>) and the last line?

or, how can I use multiple to splite message between \<PMSetup and

\<?xml version="1.0"?\> ...............................................................

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 21, 2019, 2:28pm UTC](https://discuss.elastic.co/t/remove-head-and-tail-for-xml/169331/2 "2019-02-21T14:28:50Z")

</div>

What does the data look like?

---

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [February 22, 2019, 9:02am UTC](https://discuss.elastic.co/t/remove-head-and-tail-for-xml/169331/3 "2019-02-22T09:02:49Z")

</div>

\<?xml version="1.0"?\>

---

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [February 22, 2019, 9:04am UTC](https://discuss.elastic.co/t/remove-head-and-tail-for-xml/169331/4 "2019-02-22T09:04:12Z")

</div>

![2019-02-22_170353](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5e151914c124985c806a328cbdc492884b634a69.png)

---

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [February 22, 2019, 9:05am UTC](https://discuss.elastic.co/t/remove-head-and-tail-for-xml/169331/5 "2019-02-22T09:05:03Z")

</div>

I find discuss always remove my xml post 😁  
thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 22, 2019, 1:27pm UTC](https://discuss.elastic.co/t/remove-head-and-tail-for-xml/169331/6 "2019-02-22T13:27:44Z")

</div>

It is interpreting the XML as HTML. You can either precede and follow the XML with lines containing three backticks (```) or else in the edit pane, select the XML and then click on \</\> in the toolbar above the pane, which will blockquote it.

Are you consuming the entire file as a single event?

---

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [February 25, 2019, 5:29am UTC](https://discuss.elastic.co/t/remove-head-and-tail-for-xml/169331/7 "2019-02-25T05:29:53Z")

</div>

I think splite by PMSetup is better, because each PMSetup would have 1000+ field

---

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [March 4, 2019, 3:19am UTC](https://discuss.elastic.co/t/remove-head-and-tail-for-xml/169331/8 "2019-03-04T03:19:22Z")

</div>

I choose to use python to phase and fixed this issue. thanks for helping

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2019, 3:24am UTC](https://discuss.elastic.co/t/remove-head-and-tail-for-xml/169331/9 "2019-04-01T03:24:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.