# Removing CDATA info from parsed log

**URL:** <https://discuss.elastic.co/t/removing-cdata-info-from-parsed-log/85169>\
**Category:** Logstash\
**Created:** [May 9, 2017, 11:24pm UTC](https://discuss.elastic.co/t/removing-cdata-info-from-parsed-log/85169 "2017-05-09T23:24:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kamen\_MacKay](https://avatars.discourse-cdn.com/v4/letter/k/5f9b8f/32.png) [@Kamen\_MacKay](https://discuss.elastic.co/u/Kamen_MacKay)\
**Post date:** [May 9, 2017, 11:24pm UTC](https://discuss.elastic.co/t/removing-cdata-info-from-parsed-log/85169/1 "2017-05-09T23:24:07Z")

</div>

I have a xml log file for which I'm trying to extract the XML data from. I'm using the multiline filter in filebeat on the client machine to send it as one block to logstash. It's recognized as XML when Logstash ingests it. I'm using xpath to extract some fields and rename them which is working. However, when it pulls the value from the xpath section of my logstash conf like this:

xpath =\> [  
"/request/header[3]/value/text()", "msg.user-agent" ]  
}

logstash inserts it into "msg.user-agent" as `<![CDATA[Java/1.8.0_66]]>`. How do I remove the CDATA section so it just shows 'Java/1.8.0\_66'

Here is a complete section from my log file as an example:

`

 `

Thanks,

Kamen

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2017, 11:32pm UTC](https://discuss.elastic.co/t/removing-cdata-info-from-parsed-log/85169/2 "2017-06-06T23:32:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.