# Unable to parse svclog using filbeat

**URL:** https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778
**Category:** Beats
**Tags:** filebeat
**Created:** [May 27, 2022, 8:20am UTC](https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778 "2022-05-27T08:20:04Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Gaurav\_kr](https://avatars.discourse-cdn.com/v4/letter/g/c5a1d2/32.png) [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)
#### Post date: [May 27, 2022, 8:20am UTC](https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778/1 "2022-05-27T08:20:04Z")

</div>

Hi Team,

I am unable to parse the svclog ( a XML family) using Filebeat.  
Please suggest how i can par

---

<div class="post-metadata">

### Author: ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [May 30, 2022, 3:03pm UTC](https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778/2 "2022-05-30T15:03:56Z")

</div>

Hi,

have you tried the `decode_xml`? [link](https://www.elastic.co/guide/en/beats/filebeat/current/decode-xml.html)

---

<div class="post-metadata">

### Author: ![Gaurav\_kr](https://avatars.discourse-cdn.com/v4/letter/g/c5a1d2/32.png) [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)
#### Post date: [May 31, 2022, 3:04am UTC](https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778/3 "2022-05-31T03:04:43Z")

</div>

Yes i tried but no luck

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 31, 2022, 3:13am UTC](https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778/4 "2022-05-31T03:13:07Z")

</div>

You will need to share more information if you want help, things like configs, sample data, what you tried.

---

<div class="post-metadata">

### Author: ![Gaurav\_kr](https://avatars.discourse-cdn.com/v4/letter/g/c5a1d2/32.png) [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)
#### Post date: [May 31, 2022, 7:52am UTC](https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778/5 "2022-05-31T07:52:14Z")

</div>

I am trying to parse a wcf trace files and it does not have a new line between the log elements. Instead there is a start tag/end tag . Example

I would like to store the E2ETRACEEVENT separately in ES.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 28, 2022, 9:52am UTC](https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778/6 "2022-06-28T09:52:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.