Add_tag upon max_lines reached in multiline


#1

So I am processing xml using filebeat. If an entry is longer than the allowed max_lines, the xml is incomplete, and thus invalid xml. Therefore the xml parser filter fails on these records. I was hoping to add a tag to records that reached the max_lines so i can add logic to avoid the xml filter for records who will receive _xmlparsefailure and, hopefully, perform more efficiently.


(ruflin) #2

@whyapenny Can you open a feature request for this in the Github repository?

We have one more feature request of adding a tag related to multiline here: https://github.com/elastic/beats/issues/957 not the same but potentially could be done in an implementation together.


(Steffen Siering) #3

you still want to receive events with incomplete xml? Maybe one can use a clever combination of include_lines and exclude_lines in filebeat so not to send those incomplete events to logstash at all.


(system) #4

This topic was automatically closed after 21 days. New replies are no longer allowed.