# Xml input messy fields

**URL:** <https://discuss.elastic.co/t/xml-input-messy-fields/292812>\
**Category:** Logstash\
**Created:** [December 23, 2021, 2:19pm UTC](https://discuss.elastic.co/t/xml-input-messy-fields/292812 "2021-12-23T14:19:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![abdullah144](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@abdullah144](https://discuss.elastic.co/u/abdullah144)\
**Post date:** [December 23, 2021, 2:19pm UTC](https://discuss.elastic.co/t/xml-input-messy-fields/292812/1 "2021-12-23T14:19:55Z")

</div>

Hey Guys ,

I already can sent a log to my logstash as my log is xml format , but the issue is logstash creating a new fields from tag as below :

 ![elk](https://us1.discourse-cdn.com/elastic/original/3X/2/5/254398981621f6967caa2f04630ced7737978096.png)

I want to stop him creating the new fields from logMessage tag .

My config file :

```auto
input {
 http {
	host => "10.0.90.12"
	port => 3131
    }
}
filter{
	mutate {
	remove_field => ["body","Log"]
    }
xml {
        source => "message"
	target => "doc"
	remove_namespaces => true
	force_array => false
	remove_field => ["logMessage"]
      }
}
output {
  elasticsearch { hosts => ["10.0.90.12:9200"] 
                   user => "elastic"
                   password => " ****"
                   index => "datapower"
    }
  stdout 
	{ 
        codec => plain
    }
}

```

Thank you

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 23, 2021, 2:27pm UTC](https://discuss.elastic.co/t/xml-input-messy-fields/292812/2 "2021-12-23T14:27:11Z")

</div>

> [@abdullah144](#):
>
> `remove_field => ["logMessage"]`

Perhaps you need `remove_field => ["[doc][logMessage]" ]`

---

<div class="post-metadata">

**Author:** ![abdullah144](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@abdullah144](https://discuss.elastic.co/u/abdullah144)\
**Post date:** [December 23, 2021, 2:29pm UTC](https://discuss.elastic.co/t/xml-input-messy-fields/292812/3 "2021-12-23T14:29:52Z")

</div>

Thank you @Badger

working perfect

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 20, 2022, 2:30pm UTC](https://discuss.elastic.co/t/xml-input-messy-fields/292812/4 "2022-01-20T14:30:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.