# Using logstash **URL:** \ **Category:** Logstash\ **Created:** [October 19, 2015, 6:21am UTC](https://discuss.elastic.co/t/using-logstash/32454 "2015-10-19T06:21:18Z")\ **Posts on this page:** 9\ **Page:** 1

**Author:** ![fereshteh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fereshteh/32/5926_2.png) [@fereshteh](https://discuss.elastic.co/u/fereshteh)\ **Post date:** [October 19, 2015, 6:21am UTC](https://discuss.elastic.co/t/using-logstash/32454/1 "2015-10-19T06:21:18Z")

I am trying to use the logstash documentation to set up a xml filter, but I just cant seem to get it right. My XML format is pretty straigth forward; ---

**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [October 19, 2015, 1:57pm UTC](https://discuss.elastic.co/t/using-logstash/32454/2 "2015-10-19T13:57:21Z")

@fereshteh, XML parsing should work easily, even with multiline. Consider the following input (xml.log): ```auto ``` And this Logstash Config: ```auto input { file { path => "/sample-inputs/xml.log" sincedb_path => "/dev/null" start_position => "beginning" } } filter { multiline { pattern => "^ true what => previous } xml { source => ["message"] target => ["x"] } } output { stdout { codec => rubydebug } } ``` Produces: ```auto { "message" => "\n \n \n \n \n \n\n", "@version" => "1", "@timestamp" => "2015-10-19T13:54:45.774Z", "tags" => [ [0] "multiline" ], "x" => { "lang" => "en", "class" => "sample", "head" => [ [0] { "mycompany" => "http://url.me/profile#", "meta" => [ [0] { "charset" => "utf-8", "mytag" => [ [0] { "mykey" => "myval" } ] } ] } ] } } { "message" => "\n \n \n \n \n \n", "@version" => "1", "@timestamp" => "2015-10-19T13:54:45.777Z", "tags" => [ [0] "multiline" ], "x" => { "lang" => "en", "class" => "sample", "head" => [ [0] { "mycompany" => "http://url.me/profile#", "meta" => [ [0] { "charset" => "utf-8", "mytag" => [ [0] { "mykey2" => "myval2" } ] } ] } ] } } ``` ---

**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [October 20, 2015, 7:06pm UTC](https://discuss.elastic.co/t/using-logstash/32454/4 "2015-10-20T19:06:39Z")

@fereshteh, You can do that too. If you want to parse out the attributes by [XPath](http://www.tizag.com/xmlTutorial/xpathattribute.php), do it like this: ```auto xml { store_xml => false source => ["message"] xpath => [ "/html/@lang","lang", "/html/@class","class", ] } ``` Yields: ```auto { "lang" => [ [0] "en" ], "class" => [ [0] "sample" ] } ``` Note that the attributes come out as arrays, because there can be multiple instances of the node specified by the path. If you like, you could do something like this to convert them to strings. ```auto mutate { join => { "lang" => "," } join => { "class" => "," } } ``` Yields: ```auto { "lang" => "en", "class" => "sample" } ``` HTH ---

**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [October 26, 2015, 6:10pm UTC](https://discuss.elastic.co/t/using-logstash/32454/6 "2015-10-26T18:10:57Z")

The multiline filter requires that the html tag is at the beginning of the line - make sure your input file is exactly as mine is. Let me know how it that helps! Jay ---

**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [October 27, 2015, 4:58pm UTC](https://discuss.elastic.co/t/using-logstash/32454/8 "2015-10-27T16:58:25Z")

In windows, use stdin input instead, and redirect the input of xml.log: ```auto input { stdin { } } ``` ```auto bin\logstash -f test.cfg < xml.log ``` I have not tested this, but it should work. ---

**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [November 4, 2015, 1:49pm UTC](https://discuss.elastic.co/t/using-logstash/32454/10 "2015-11-04T13:49:20Z")

@fereshteh, In your initial question, the XML was formatted on multiple lines, so we used the multiline filter. Is your expected input always on a single line? Or do you still expect to see events over multiple lines? ---

**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [November 4, 2015, 2:07pm UTC](https://discuss.elastic.co/t/using-logstash/32454/11 "2015-11-04T14:07:41Z")

You can use the following to split your single line XML into multiple lines: ```auto mutate { gsub => ["message", " ["message"] target => ["x"] } ``` ---

**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [November 10, 2015, 3:17pm UTC](https://discuss.elastic.co/t/using-logstash/32454/13 "2015-11-10T15:17:37Z")

@fereshteh, In that case, you need to first extract the XML from the rest of the message using GROK like so: ```auto filter { grok { match => { "message" => ".*(?).*" } } xml { store_xml => false source => ["the_xml"] xpath => [ "/html/@lang","lang", "/html/@class","class" ] } } ``` ---

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:22am UTC](https://discuss.elastic.co/t/using-logstash/32454/15 "2017-07-06T05:22:43Z")