I am trying to parse logs with XML data using XML filter but it is giving me syntax error.
here is my log line:
this is configuration of XML filter:
xml {
source => "siebelfexception"
store_xml => false
xpath => ['/SOAP-ENV:Envelope[@xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"]/SOAP-ENV:Body/SOAP-ENV:Fault/detail/siebelf:siebdetail[@xmlns:siebelf="http://www.siebel.com/ws/fault"]/siebelf:errorstack/siebelf:error/siebelf:errorcode
',"siebelErrCode"]
this is the error i am getting:
[2017-06-14T18:29:59,867][ERROR][logstash.pipeline ] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>"/SOAP-ENV:Envelope[@ :SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/\"]/SOAP-ENV:Body/SOAP-ENV:Fault/detail/siebelf:siebdetail[@ :siebelf="http://www.siebel.com/ws/fault\"]/siebelf:errorstack/siebelf:error/siebelf:errorcode", "backtrace"=>["nokogiri/XmlXpathContext.java:169:in
evaluate'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:165:in
xpath'", "org/jruby/RubyArray.java:2414:inmap'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:156:in
xpath'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:153:infilter'", "org/jruby/RubyHash.java:1342:in
each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:152:infilter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in
do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:inmulti_filter'", "org/jruby/RubyArray.java:1613:in
each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:inmulti_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:43:in
multi_filter'", "(eval):126:infilter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:in
filter_batch'", "org/jruby/RubyProc.java:281:incall'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:224:in
each'", "org/jruby/RubyHash.java:1342:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:in
each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:369:infilter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:in
worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:instart_workers'"]} [2017-06-14T18:30:00,046][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<Nokogiri::XML::XPath::SyntaxError: /SOAP-ENV:Envelope[@ :SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"]/SOAP-ENV:Body/SOAP-ENV:Fault/detail/siebelf:siebdetail[@ :siebelf="http://www.siebel.com/ws/fault"]/siebelf:errorstack/siebelf:error/siebelf:errorcode>, :backtrace=>["nokogiri/XmlXpathContext.java:169:in
evaluate'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:165:inxpath'", "org/jruby/RubyArray.java:2414:in
map'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/nokogiri-1.7.0.1-java/lib/nokogiri/xml/searchable.rb:156:inxpath'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:153:in
filter'", "org/jruby/RubyHash.java:1342:ineach'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.2/lib/logstash/filters/xml.rb:152:in
filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:indo_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in
multi_filter'", "org/jruby/RubyArray.java:1613:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in
multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:43:inmulti_filter'", "(eval):126:in
filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:infilter_batch'", "org/jruby/RubyProc.java:281:in
call'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:224:ineach'", "org/jruby/RubyHash.java:1342:in
each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:369:in
filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:inworker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:in
start_workers'"]}
thanks in advance.