I have an XML file which is gonna be updated arbitrary by another program by appending new documents each time...
This file also will be initialized every day by depopulating it.
I configured filebeat to catch every XML document inside this file matching this format
<H_Ticket>...</H_Ticket> using this configuration:
# List of prospectors to fetch data. prospectors: paths: - C:\busesdata\*.xml input_type: log exclude_lines: ["^.*xml"] #ignore_older: 10s #close_older: 1h document_type: ticket scan_frequency: 15s multiline: pattern: '<H_Ticket' negate: true match: after output: ### Logstash as output logstash: hosts: ["localhost:5044"] index: filebeat
It works very well when adding many XML docs at the end of the file, but it sends an empty event when adding a single document, for example:
=> it works properly
=> empty event
- First, Is this behavior is due to a wrong multiline or other miss configuration or what?
- Second, in my case, do I have to use ignore_older and close_older params to guarantee a smooth pipeline process or not? if yes how it might be set in my case?
Thank you in advance