# XML LOGSTASH configuration

**URL:** <https://discuss.elastic.co/t/xml-logstash-configuration/88290>\
**Category:** Logstash\
**Created:** [June 5, 2017, 3:33pm UTC](https://discuss.elastic.co/t/xml-logstash-configuration/88290 "2017-06-05T15:33:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aylwinns\_Tan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aylwinns_tan/32/20038_2.png) [@Aylwinns\_Tan](https://discuss.elastic.co/u/Aylwinns_Tan)\
**Post date:** [June 5, 2017, 3:33pm UTC](https://discuss.elastic.co/t/xml-logstash-configuration/88290/1 "2017-06-05T15:33:36Z")

</div>

Hi all,

Im trying to configure logstash for an XML log but i cant seem to get it right.

This is my configuration:  
xml {  
source =\> "message"  
target =\> "Full.XML"  
xpath =\>  
[  
"/LogRoot/LogMessage/text()", "Info",  
"/LogRoot/GuiRoot/batch[@execution="synchronous"]/getJobDetailsResponse/user/text()", "User"  
] }

And this is my error:

Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=\>"/LogRoot/GuiRoot/batch\[\@execution\=\"synchronous\"\]/getJobDetailsResponse/user/text()", "backtrace"=\>["nokogiri/XmlXpathContext.java:169:in `evaluate'", "/murex/ELK/ELKinstall/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:165:in`xpath'", "org/jruby/RubyArray.java:2414:in `map'", "/murex/ELK/ELKinstall/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:156:in`xpath'", "/murex/ELK/ELKinstall/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:153:in `filter'", "org/jruby/RubyHash.java:1342:in`each'", "/murex/ELK/ELKinstall/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:152:in `filter'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/filters/base.rb:145:in`do\_filter'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/filters/base.rb:164:in `multi_filter'", "org/jruby/RubyArray.java:1613:in`each'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/filters/base.rb:161:in `multi_filter'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/filter_delegator.rb:43:in`multi\_filter'", "(eval):1387:in `initialize'", "org/jruby/RubyArray.java:1613:in`each'", "(eval):1383:in `initialize'", "org/jruby/RubyProc.java:281:in`call'", "(eval):557:in `filter_func'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:370:in`filter\_batch'", "org/jruby/RubyProc.java:281:in `call'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:224:in`each'", "org/jruby/RubyHash.java:1342:in `each'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:in`each'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:369:in `filter_batch'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:350:in`worker\_loop'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:317:in `start_workers'"]} [2017-06-05T16:46:37,964][FATAL][logstash.runner] An unexpected error occurred! {:error=>#<Nokogiri::XML::XPath::SyntaxError: /LogRoot/GuiRoot/batch\[\@execution\=\"synchronous\"\]/getJobDetailsResponse/user/text()>, :backtrace=>["nokogiri/XmlXpathContext.java:169:in`evaluate'", "/murex/ELK/ELKinstall/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:165:in `xpath'", "org/jruby/RubyArray.java:2414:in`map'", "/murex/ELK/ELKinstall/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:156:in `xpath'", "/murex/ELK/ELKinstall/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:153:in`filter'", "org/jruby/RubyHash.java:1342:in `each'", "/murex/ELK/ELKinstall/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:152:in`filter'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/filters/base.rb:145:in `do_filter'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/filters/base.rb:164:in`multi\_filter'", "org/jruby/RubyArray.java:1613:in `each'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/filters/base.rb:161:in`multi\_filter'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/filter\_delegator.rb:43:in `multi_filter'", "(eval):1387:in`initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):1383:in`initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):557:in`filter\_func'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:370:in `filter_batch'", "org/jruby/RubyProc.java:281:in`call'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:224:in `each'", "org/jruby/RubyHash.java:1342:in`each'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:223:in `each'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:369:in`filter\_batch'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:350:in `worker_loop'", "/murex/ELK/ELKinstall/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:317:in`start\_workers'"]}

Thanks for the help

Greatly appreciated

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 8, 2017, 4:33am UTC](https://discuss.elastic.co/t/xml-logstash-configuration/88290/2 "2017-06-08T04:33:41Z")

</div>

Logstash doesn't treat character escapes very well. Instead of

```
"/LogRoot/GuiRoot/batch[\@execution\=\"synchronous\"]/getJobDetailsResponse/user/text()"

```

try this:

```
'/LogRoot/GuiRoot/batch[@execution="synchronous"]/getJobDetailsResponse/user/text()'
```

---

<div class="post-metadata">

**Author:** ![Aylwinns\_Tan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aylwinns_tan/32/20038_2.png) [@Aylwinns\_Tan](https://discuss.elastic.co/u/Aylwinns_Tan)\
**Post date:** [June 8, 2017, 5:15am UTC](https://discuss.elastic.co/t/xml-logstash-configuration/88290/3 "2017-06-08T05:15:06Z")

</div>

thanks 🙂 it's working now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:15am UTC](https://discuss.elastic.co/t/xml-logstash-configuration/88290/4 "2017-07-06T05:15:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.