# XML filter or prune filter more suited for this log file? Or simply grok it?

**URL:** <https://discuss.elastic.co/t/xml-filter-or-prune-filter-more-suited-for-this-log-file-or-simply-grok-it/153862>\
**Category:** Logstash\
**Created:** [October 24, 2018, 6:59pm UTC](https://discuss.elastic.co/t/xml-filter-or-prune-filter-more-suited-for-this-log-file-or-simply-grok-it/153862 "2018-10-24T18:59:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Callahan](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Callahan](https://discuss.elastic.co/u/Callahan)\
**Post date:** [October 24, 2018, 6:59pm UTC](https://discuss.elastic.co/t/xml-filter-or-prune-filter-more-suited-for-this-log-file-or-simply-grok-it/153862/1 "2018-10-24T18:59:29Z")

</div>

This is the output I get from querying a Sonos speaker using a Python script that I've got outputting to a file. I have 2 questions. Firstly, my aim is to extract only a small segment of info from this text file. Specifically, I want to only extract the following :  
dc:titleFinally Moving\</dc:title\>  
dc:creatorPretty Lights\</dc:creator\>  
upnp:albumPrime Chill\</upnp:album\>

Prune seems to be more suited to this as there is so little I actually want from this file.

My second question is, I plan to run this script every 5 mins and output the log file overwriting the existing output file. Can anyone confirm my beleif that when Logstash sees a new file, it will ingest it and throw the results to Elasticsearch even if the output file has the same name?

The content I want to filter:

```
e[37mResponse:
e[36m{u'AbsTime': u'NOT_IMPLEMENTED', u'@xmlns:u': u'urn:schemas-upnp-org:service:AVTransport:1', u'Track': u'30', u'TrackDuration': u'0:04:38', u'TrackURI': u'x-sonosapi-hls-static:catalog%2ftracks%2fB0037858OA%2f%3fplaylistAsin%3dB07J1GFY3G%26playlistType%3dprimePlaylist?sid=201&flags=0&sn=1', u'RelTime': u'0:00:21', u'TrackMetaData': u'<DIDL-Lite xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:upnp="urn:schemas-upnp-org:metadata-1-0/upnp/" xmlns:r="urn:schemas-rinconnetworks-com:metadata-1-0/" xmlns="urn:schemas-upnp-org:metadata-1-0/DIDL-Lite/"><item id="-1" parentID="-1" restricted="true"><res protocolInfo="sonos.com-http:*:application/x-mpegURL:*" duration="0:04:38">x-sonosapi-hls-static:catalog%2ftracks%2fB0037858OA%2f%3fplaylistAsin%3dB07J1GFY3G%26playlistType%3dprimePlaylist?sid=201&amp;flags=0&amp;sn=1</res><r:streamContent></r:streamContent><upnp:albumArtURI>/getaa?s=1&amp;u=x-sonosapi-hls-static%3acatalog%252ftracks%252fB0037858OA%252f%253fplaylistAsin%253dB07J1GFY3G%2526playlistType%253dprimePlaylist%3fsid%3d201%26flags%3d0%26sn%3d1</upnp:albumArtURI><dc:title>Finally Moving</dc:title><upnp:class>object.item.audioItem.musicTrack</upnp:class><dc:creator>Pretty Lights</dc:creator><upnp:album>Prime Chill</upnp:album></item></DIDL-Lite>', u'RelCount': u'2147483647', u'AbsCount': u'2147483647'}

```

Thanks for any advice you have.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 21, 2018, 6:59pm UTC](https://discuss.elastic.co/t/xml-filter-or-prune-filter-more-suited-for-this-log-file-or-simply-grok-it/153862/2 "2018-11-21T18:59:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.