Add_tag upon max_lines reached in multiline

So I am processing xml using filebeat. If an entry is longer than the allowed max_lines, the xml is incomplete, and thus invalid xml. Therefore the xml parser filter fails on these records. I was hoping to add a tag to records that reached the max_lines so i can add logic to avoid the xml filter for records who will receive _xmlparsefailure and, hopefully, perform more efficiently.

@whyapenny Can you open a feature request for this in the Github repository?

We have one more feature request of adding a tag related to multiline here: not the same but potentially could be done in an implementation together.

you still want to receive events with incomplete xml? Maybe one can use a clever combination of include_lines and exclude_lines in filebeat so not to send those incomplete events to logstash at all.

This topic was automatically closed after 21 days. New replies are no longer allowed.