# XML encoded logs from Mcafee EPO logs to logstash

**URL:** <https://discuss.elastic.co/t/xml-encoded-logs-from-mcafee-epo-logs-to-logstash/104380>\
**Category:** Logstash\
**Created:** [October 18, 2017, 11:05am UTC](https://discuss.elastic.co/t/xml-encoded-logs-from-mcafee-epo-logs-to-logstash/104380 "2017-10-18T11:05:48Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 23, 2017, 1:09pm UTC](https://discuss.elastic.co/t/xml-encoded-logs-from-mcafee-epo-logs-to-logstash/104380/5 "2017-10-23T13:09:13Z")

</div>

Use a grok filter to extract timestamp and other parts of the message to separate fields. One of the fields should contain the XML payload and that's the field you then reference in your xml filter.

---

_[View the full topic](https://discuss.elastic.co/t/xml-encoded-logs-from-mcafee-epo-logs-to-logstash/104380)._