# XML response from unstructured log **URL:** \ **Category:** Logstash\ **Created:** [January 6, 2020, 4:18pm UTC](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916 "2020-01-06T16:18:20Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Kishorekolla](https://avatars.discourse-cdn.com/v4/letter/k/5fc32e/32.png) [@Kishorekolla](https://discuss.elastic.co/u/Kishorekolla)\ **Post date:** [January 6, 2020, 4:18pm UTC](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916/1 "2020-01-06T16:18:21Z")
Hi Team, I'm a beginner to logstash. Till now worked on configuring basic Input, Filebeats and Output plugins by following product documents which are available in the official website. Now I have a real time scenario below, I have an unstructured log file (abc.log) which is stored in the local folder, and it is the combination of Junk info and XML response in between. I need to extract only XML response from the log file through logstash pipeline. Please guide me to achieve this. Appreciate the quick response! Thanks Kishore K ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 6, 2020, 5:47pm UTC](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916/2 "2020-01-06T17:47:10Z")
If there is valid XML in the middle of a field an xml filter with store\_xml set to true will find it and parse it. (xpath on the other hand will reject it.) ``` input { generator { count => 1 lines => ['2020/01/02 08:40:16 here is some XML: 12 and more stuff'] } } filter { xml { source => "message" target => "theXML" } } output { stdout { codec => rubydebug { metadata => false } } } ``` will get you ``` "theXML" => { "c" => [ [0] "2" ], "b" => [ [0] "1" ] }, ``` ---
**Author:** ![Kishorekolla](https://avatars.discourse-cdn.com/v4/letter/k/5fc32e/32.png) [@Kishorekolla](https://discuss.elastic.co/u/Kishorekolla)\ **Post date:** [January 9, 2020, 4:01pm UTC](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916/3 "2020-01-09T16:01:47Z")
Hi, Thanks for the prompt response. I have small difficulty in my log file which is not extracting XML response. Below is the sample example of my log file. ``` 2020/01/02 08:40:16 here is some XML: 1 2 and more stuff 2020/01/02 08:40:16 here is some XML: 2020/01/02 08:40:16 here is some XML: 2020/01/02 08:40:16 here is some XML: 2020/01/02 08:40:16 here is some XML: 1 2 ``` Above log file contains junk in between and XML response in separate lines. When i combine XML in one line like (`12`), then the output is coming as like you mentioned, otherwise logstash is considering the single line as single event in the output. It is very difficult to combine all the XML tags in single line manually since the log file is huge and having more number of XML responses in between. Please guide me to achieve extracting XMLs from the above log file. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 9, 2020, 5:55pm UTC](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916/4 "2020-01-09T17:55:53Z")
You will need to get each XML object into its own event. It may be possible to use a multiline filter that matches , such as ``` codec => multiline { pattern => '^\s*' negate => true what => "next" auto_flush_interval => 1 } ``` or possibly match the date and accept that you need to drop {} the messages that do not contain XML ``` codec => multiline { pattern => '^[0-9/]{10} [0-9:]{8}' negate => true what => "previous" auto_flush_interval => 1 } ``` ---
**Author:** ![Kishorekolla](https://avatars.discourse-cdn.com/v4/letter/k/5fc32e/32.png) [@Kishorekolla](https://discuss.elastic.co/u/Kishorekolla)\ **Post date:** [January 14, 2020, 7:45am UTC](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916/5 "2020-01-14T07:45:40Z")
Thanks Badger, It got worked well. Small clarification. Why `` tag is not showing in 'theXML' object output. If we want to show that also, how can we bring that in 'theXML' object output. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 14, 2020, 2:17pm UTC](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916/6 "2020-01-14T14:17:54Z")
> [@Kishorekolla](#): > > Why `` tag is not showing in 'theXML' object output. That's just the way it works. The target contains the contents of the outermost XML object, not the outermost object itself. ---
**Author:** ![Kishorekolla](https://avatars.discourse-cdn.com/v4/letter/k/5fc32e/32.png) [@Kishorekolla](https://discuss.elastic.co/u/Kishorekolla)\ **Post date:** [January 20, 2020, 7:25am UTC](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916/7 "2020-01-20T07:25:07Z")
Understood. But my question here is i have two different XML objects in the log file. One is `` and other is ``. So i have to differentiate both XML objects. Please guide me if there is any other way to bring in. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 17, 2020, 7:25am UTC](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916/8 "2020-02-17T07:25:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.