So I am processing xml using filebeat. If an entry is longer than the allowed max_lines, the xml is incomplete, and thus invalid xml. Therefore the xml parser filter fails on these records. I was hoping to add a tag to records that reached the max_lines so i can add logic to avoid the xml filter for records who will receive _xmlparsefailure and, hopefully, perform more efficiently.
@whyapenny Can you open a feature request for this in the Github repository?
We have one more feature request of adding a tag related to multiline here: https://github.com/elastic/beats/issues/957 not the same but potentially could be done in an implementation together.
you still want to receive events with incomplete xml? Maybe one can use a clever combination of include_lines and exclude_lines in filebeat so not to send those incomplete events to logstash at all.
This topic was automatically closed after 21 days. New replies are no longer allowed.