DMARC XML parsing with logstash and Graylog

blason · January 1, 2019, 5:32pm

Hi Guys,

Has anyone done parsing of XML files into Graylog? I am trying that but logs are not being ingested.

can someone please help me about parsing XML files into graylog? I am trying to parse DMARC XML files into graylog.

TIA
Blason R

konrad · January 2, 2019, 3:38pm

As @jochen already pointed out in Extracting XML fields parsing of XML should happen before putting the logs into graylog.

blason · January 2, 2019, 5:46pm

Yes that is obvious and I am trying with logstash with below config or using the @wwalker config.

somehow the logs are not being ingested then.

Here is the config file I am referring to

github.com

wwalker0307/ElasticMARC/blob/master/logstash/config/pipelines/dmarcpipeline.yml

input {
  file {
    id => "Ingest\DMARC\*.xml"
    path => "D:/ElasticStack/Ingest/DMARC/*.xml"
    discover_interval => 5
    codec => multiline {
      auto_flush_interval => 5
      negate => true
      pattern => "<record>"
      what => "previous"
      multiline_tag => ""
    }
  }
}
filter {
  xml {
    id => "Field Extraction"
    store_xml => false
    source => "message"
    xpath => [

This file has been truncated. show original

jtkarvo · January 2, 2019, 6:27pm

Don’t try to write directly to elasticsearch, but use logstash GELF output plugin and a GELF input in Graylog.

blason · January 3, 2019, 2:37am

This is what is done exactly!!! But dang its not going through. May be I try to debug now.

system · January 17, 2019, 2:37am

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Unable to parse JSON logs in Graylog Graylog Central (peer support)	9	2443	January 21, 2019
Problem with parsing Graylog Central (peer support) elastic	2	252	July 21, 2023
Use Graylog and Kibana at the same time Graylog Central (peer support)	5	5604	March 28, 2019
Index Error - mapper_parse_Exception Graylog Central (peer support)	1	796	January 19, 2018
Graylog set up and working, but trying to move data directory Graylog Central (peer support) elastic	11	1811	May 26, 2022

DMARC XML parsing with logstash and Graylog

Related Topics