Filebeat decode_xml processor missing

Hi.
I'm facing issues trying to configure decode_xml processor in filebeat version 7.11.

The error is the following:

    Failed to start crawler: starting input failed: Error while initializing input: the processor action decode_xml does not exist. Valid actions: drop_event, include_fields, add_cloud_metadata, add_locale, convert, add_fields, add_tags, dissect, fingerprint, rate_limit, decode_base64_field, add_observer_metadata, add_id, script, add_cloudfoundry_metadata, add_labels, add_host_metadata, copy_fields, dns, registered_domain, add_docker_metadata, decode_csv_fields, decode_cef, add_process_metadata, extract_array, timestamp, decompress_gzip_field, community_id, urldecode, add_kubernetes_metadata, detect_mime_type, rename, drop_fields, replace, truncate_fields, add_network_direction, decode_json_fields
    github.com/elastic/beats/v7/libbeat/processors.New
            /go/src/github.com/elastic/beats/libbeat/processors/processor.go:106

My configuration is as follows:

filebeat.inputs:
    - type: log
      paths:
        - /<PATH>
      processors:
        - decode_xml:
            field: message
            target_field: "xml"
            overwrite_keys: true

....

Hi @Francisco_Peralta_Gu , try 7.12, that's when it was introduced.

The docs for 7.11 do not mention decode_xml. Define processors | Filebeat Reference [7.11] | Elastic

1 Like

Thank you @andrewkroh .
Trying with 7.12 version I am getting the following error:

 instance/beat.go:971    Exiting: Failed to start crawler: starting input failed: Error while initializing input: missing fields option in filebeat.inputs.0.processors.0.decode_xml
Exiting: Failed to start crawler: starting input failed: Error while initializing input: missing fields option in filebeat.inputs.0.processors.0.decode_xml

This is the configuration of my input

   filebeat.inputs:
    - type: log
      paths:
        - /dumps/**
      processors:
        - decode_xml:
            field: message
            target_field: xml
            ignore_missing: true
            ignore_failure: true

Once I activated the debug mode I cannot see more info that I include below:

2021-04-06T07:02:44.851Z	INFO	[monitoring]	log/log.go:152	Total non-zero metrics	{"monitoring": {"metrics": {"beat":{"cgroup":{"cpu":{"cfs":{"period":{"us":100000},"quota":{"us":400000}},"id":"crio-68f84aa9cf563e928781488cefeae8870012bea8879bb84507933164a1a2f420.scope","stats":{"periods":2}},"cpuacct":{"id":"crio-68f84aa9cf563e928781488cefeae8870012bea8879bb84507933164a1a2f420.scope","total":{"ns":180222497}},"memory":{"id":"crio-68f84aa9cf563e928781488cefeae8870012bea8879bb84507933164a1a2f420.scope","mem":{"limit":{"bytes":1073741824},"usage":{"bytes":44670976}}}},"cpu":{"system":{"ticks":50,"time":{"ms":56}},"total":{"ticks":140,"time":{"ms":149},"value":140},"user":{"ticks":90,"time":{"ms":93}}},"handles":{"limit":{"hard":1048576,"soft":1048576},"open":8},"info":{"ephemeral_id":"1030b8cd-8c29-463a-bd66-5df3c6973349","uptime":{"ms":86}},"memstats":{"gc_next":18425648,"memory_alloc":16343096,"memory_sys":76366848,"memory_total":52962720,"rss":84951040},"runtime":{"goroutines":11}},"filebeat":{"harvester":...
2021-04-06T07:02:44.851Z	INFO	[monitoring]	log/log.go:153	Uptime: 87.107058ms
2021-04-06T07:02:44.851Z	INFO	[monitoring]	log/log.go:130	Stopping metrics logging.
2021-04-06T07:02:44.851Z	INFO	instance/beat.go:474	filebeat stopped.
2021-04-06T07:02:44.851Z	ERROR	instance/beat.go:971	Exiting: Failed to start crawler: starting input failed: Error while initializing input: missing fields option in filebeat.inputs.0.processors.0.decode_xml
Exiting: Failed to start crawler: starting input failed: Error while initializing input: missing fields option in filebeat.inputs.0.processors.0.decode_xml

Please could you tell me if there is there any configuration mistake, bug or anything else?

Hi.
Please we need information about if the configuration is applied right or if this is an issue of the module decode_xml.

Thank you!

Hello @Francisco_Peralta_Gu , this has confirmed to be a bug, and will be resolved in 7.13 and 7.12.2 releases unless something changes.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.