# XML filter not parsing

**URL:** <https://discuss.elastic.co/t/xml-filter-not-parsing/151078>\
**Category:** Logstash\
**Created:** [October 4, 2018, 4:15pm UTC](https://discuss.elastic.co/t/xml-filter-not-parsing/151078 "2018-10-04T16:15:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tropas](https://avatars.discourse-cdn.com/v4/letter/t/d9b06d/32.png) [@tropas](https://discuss.elastic.co/u/tropas)\
**Post date:** [October 4, 2018, 4:15pm UTC](https://discuss.elastic.co/t/xml-filter-not-parsing/151078/1 "2018-10-04T16:15:02Z")

</div>

I'm using packetbeat to sniff network traffic (only http), which I'm then trying to parse (as it's all XML) with logstash.

my logstash file looks like:  
filter {  
if [method] == "PUT" {  
xml {  
source =\> "%{[http][request][body]}"  
target =\> "xml\_message"  
add\_tag =\> ["found-xml"]  
}  
}  
}

```
output {
  if [method] == "PUT" {
    if [http][request][headers][content-type] == "application/xml" {
                stdout { codec => rubydebug }
                }
     }
         }

```

The output shows the body field does contain XML (i.e. packetbeat is capturing it), however logstash just refuses to parse the XML for me. also, it doesn't seem to add\_tag either, but will remove fields if i put them in the same xml {} block.

The xml in the body of the payload is valid (and i've simplified it to just one tag value and it still doesn't parse.

Thanks

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [October 4, 2018, 7:44pm UTC](https://discuss.elastic.co/t/xml-filter-not-parsing/151078/2 "2018-10-04T19:44:16Z")

</div>

Why not use the `beats` input to take the traffic and let it handle the parsing on its own?

---

<div class="post-metadata">

**Author:** ![tropas](https://avatars.discourse-cdn.com/v4/letter/t/d9b06d/32.png) [@tropas](https://discuss.elastic.co/u/tropas)\
**Post date:** [October 4, 2018, 11:19pm UTC](https://discuss.elastic.co/t/xml-filter-not-parsing/151078/3 "2018-10-04T23:19:48Z")

</div>

Apologies - I am using the beats input plugin (file not shown). The xml I’m trying to parse is in the http body...which gets presented by beats (in the ruby output) but trying to then parse this field with the xml filter just doesn’t seem to do anything

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [October 5, 2018, 3:03pm UTC](https://discuss.elastic.co/t/xml-filter-not-parsing/151078/4 "2018-10-05T15:03:49Z")

</div>

Do you have an example you can give...I don't understand why/where the beats plugin presents XML data.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 5, 2018, 5:07pm UTC](https://discuss.elastic.co/t/xml-filter-not-parsing/151078/5 "2018-10-05T17:07:04Z")

</div>

Please show us an example document that wasn't processed correctly.

---

<div class="post-metadata">

**Author:** ![tropas](https://avatars.discourse-cdn.com/v4/letter/t/d9b06d/32.png) [@tropas](https://discuss.elastic.co/u/tropas)\
**Post date:** [October 7, 2018, 9:07am UTC](https://discuss.elastic.co/t/xml-filter-not-parsing/151078/6 "2018-10-07T09:07:56Z")

</div>

So, after extensive testing I've learnt a few things;

1. source =\> needs to map to a simple field - e.g. "xml\_content" - to achieve this I used an earlier mutux to copy the field add\_field =\> {"xml" =\> "%{[http][request][body]}" }

2. There appears to be a bug in packetbeat where if the http body \> 1024 bytes it doesn't send it to either logstash or elasticsearch (tried both configurations).

I've got successful parsing otherwise. I'll raise a new bug for the payload size issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2018, 9:07am UTC](https://discuss.elastic.co/t/xml-filter-not-parsing/151078/7 "2018-11-04T09:07:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.