Error while parsing logs with XML data

I am trying to parse logs with XML data using XML filter but it is giving me syntax error.
here is my log line:

this is configuration of XML filter:

xml {
source => "siebelfexception"
store_xml => false
xpath => ['/SOAP-ENV:Envelope[@xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"]/SOAP-ENV:Body/SOAP-ENV:Fault/detail/siebelf:siebdetail[@xmlns:siebelf="http://www.siebel.com/ws/fault"]/siebelf:errorstack/siebelf:error/siebelf:errorcode
',"siebelErrCode"]

this is the error i am getting:

[2017-06-14T18:29:59,867][ERROR][logstash.pipeline ] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>"/SOAP-ENV:Envelope[@ :SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"]/SOAP-ENV:Body/SOAP-ENV:Fault/detail/siebelf:siebdetail[@ :siebelf="http://www.siebel.com/ws/fault"]/siebelf:errorstack/siebelf:error/siebelf:errorcode", "backtrace"=>["nokogiri/XmlXpathContext.java:169:in evaluate'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:165:inxpath'", "org/jruby/RubyArray.java:2414:in map'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:156:inxpath'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:153:in filter'", "org/jruby/RubyHash.java:1342:ineach'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:152:in filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:indo_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in multi_filter'", "org/jruby/RubyArray.java:1613:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:43:inmulti_filter'", "(eval):126:in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:infilter_batch'", "org/jruby/RubyProc.java:281:in call'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:224:ineach'", "org/jruby/RubyHash.java:1342:in each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:369:in filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:inworker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:in start_workers'"]} [2017-06-14T18:30:00,046][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<Nokogiri::XML::XPath::SyntaxError: /SOAP-ENV:Envelope[@ :SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"]/SOAP-ENV:Body/SOAP-ENV:Fault/detail/siebelf:siebdetail[@ :siebelf="http://www.siebel.com/ws/fault"]/siebelf:errorstack/siebelf:error/siebelf:errorcode>, :backtrace=>["nokogiri/XmlXpathContext.java:169:inevaluate'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:165:in xpath'", "org/jruby/RubyArray.java:2414:inmap'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:156:in xpath'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:153:infilter'", "org/jruby/RubyHash.java:1342:in each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:152:infilter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:inmulti_filter'", "org/jruby/RubyArray.java:1613:in each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:inmulti_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:43:in multi_filter'", "(eval):126:infilter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:in filter_batch'", "org/jruby/RubyProc.java:281:incall'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:224:in each'", "org/jruby/RubyHash.java:1342:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:in each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:369:infilter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:instart_workers'"]}

thanks in advance.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.