# XML Multiline pattern problems with Logstash

**URL:** <https://discuss.elastic.co/t/xml-multiline-pattern-problems-with-logstash/103350>\
**Category:** Logstash\
**Created:** [October 10, 2017, 11:09am UTC](https://discuss.elastic.co/t/xml-multiline-pattern-problems-with-logstash/103350 "2017-10-10T11:09:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![MiguelLopes](https://avatars.discourse-cdn.com/v4/letter/m/65b543/32.png) [@MiguelLopes](https://discuss.elastic.co/u/MiguelLopes)\
**Post date:** [October 10, 2017, 11:09am UTC](https://discuss.elastic.co/t/xml-multiline-pattern-problems-with-logstash/103350/1 "2017-10-10T11:09:43Z")

</div>

Hello all,  
We are having difficulties setting up a multiline pattern that must be triggered whenever xml data is found in the event.

We are facing the following problem.. If we set the timestamp as an multi-line pattern ( in our case pattern =\> "^%{TIMESTAMP\_ISO8601} ) all single-line and multi-line events will be classified as multi-line and gets processed oke, but when we try to narrow it down by including an xml tag to eg: "^%{TIMESTAMP\_ISO8601}._\<?xml" or "^%{TIMESTAMP\_ISO8601}._\<?xml" the output gets completely messed up and inserts single-line events into multi-line events. Or it just breaks the multi-line events into separate events.

Log example: [https://pastebin.com/x7Dg1Aki](https://pastebin.com/x7Dg1Aki)  
Logstash output example: [https://pastebin.com/CD0t4qvx](https://pastebin.com/CD0t4qvx)  
Logstash conf example: [https://pastebin.com/Ag74fuBs](https://pastebin.com/Ag74fuBs)

Hopefully somebody can advice us un this subject!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2017, 11:09am UTC](https://discuss.elastic.co/t/xml-multiline-pattern-problems-with-logstash/103350/2 "2017-11-07T11:09:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.