Bug with split filter and XML

Elastic Stack Logstash
1

Hi, parsing some XMLs Logstash randomly stops the pipeline with the following error:

LogStash::ConfigurationError: Only String and Array types are splittable. field:[User] is of type = NilClass
         filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-split-2.0.5/lib/logstash/filters/split.rb:49
   multi_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/filters/base.rb:151
           each at org/jruby/RubyArray.java:1613
   multi_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/filters/base.rb:148
    filter_func at (eval):347
   filter_batch at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:267
           each at org/jruby/RubyArray.java:1613
         inject at org/jruby/RubyEnumerable.java:852
   filter_batch at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:265
    worker_loop at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:223
  start_workers at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:201

I can't figure out why, since it never stops at the same point parsing the XML. It doesn't seem an issue of the data itself.
I've experimented with both multiline codec and multiline filter managing the XML.
I'm on Logstash 2.4.0.

What can I do to fix this issue?

2

You're trying to split a field named User but the event didn't have such a field.

3

Thanks! In fact I managed to solve inverting the order in which the XML filters are processed.
And now I understood the error message :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.