# Urgent help needed : Filebeat xml question **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 18, 2017, 8:23pm UTC](https://discuss.elastic.co/t/urgent-help-needed-filebeat-xml-question/82774 "2017-04-18T20:23:14Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![anshul\_pandey](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@anshul\_pandey](https://discuss.elastic.co/u/anshul_pandey)\ **Post date:** [April 18, 2017, 8:23pm UTC](https://discuss.elastic.co/t/urgent-help-needed-filebeat-xml-question/82774/1 "2017-04-18T20:23:14Z")
Hi, I am trying to read IO logs files using file beat and having issues with the getting all the lines of xml into the logstash. here is sample of what i am trying to read [https://play.golang.org/p/wZL0Vd3tx\_](https://play.golang.org/p/wZL0Vd3tx_) The problem is this sample works , however event coming from file beat always misses the closing tag. The same xml when read via File beats filter, is giving me in\_xml as following ```auto 1 ,mydi Facilty AVD 12333 1 aCD ``` Note the WSI\_transaction closing tag is missing. I have following as file beat multiple line settings, Since my xml can start with any of the following tags, hence the first line has multiple tags for first match. ``` multiline.pattern: '^(|||)' multiline.negate: true multiline.match: after ``` logstash config uses greedy data to get everything match =\> { "message" =\> "%{GREEDYDATA:inxml}" } Can i can some help in understanding this behavior ? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 20, 2017, 9:48am UTC](https://discuss.elastic.co/t/urgent-help-needed-filebeat-xml-question/82774/2 "2017-04-20T09:48:39Z")
1. filebeat version? 2. Is the closing tag send as a separate event? 3. indentation of `multiline`-namespace looks somewhat off. This just copy'n paste? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 18, 2017, 9:52am UTC](https://discuss.elastic.co/t/urgent-help-needed-filebeat-xml-question/82774/3 "2017-05-18T09:52:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.