Filebeat decode_xml processor missing

Elastic Stack Beats
1

Hi.
I'm facing issues trying to configure decode_xml processor in filebeat version 7.11.

The error is the following:

    Failed to start crawler: starting input failed: Error while initializing input: the processor action decode_xml does not exist. Valid actions: drop_event, include_fields, add_cloud_metadata, add_locale, convert, add_fields, add_tags, dissect, fingerprint, rate_limit, decode_base64_field, add_observer_metadata, add_id, script, add_cloudfoundry_metadata, add_labels, add_host_metadata, copy_fields, dns, registered_domain, add_docker_metadata, decode_csv_fields, decode_cef, add_process_metadata, extract_array, timestamp, decompress_gzip_field, community_id, urldecode, add_kubernetes_metadata, detect_mime_type, rename, drop_fields, replace, truncate_fields, add_network_direction, decode_json_fields
    github.com/elastic/beats/v7/libbeat/processors.New
            /go/src/github.com/elastic/beats/libbeat/processors/processor.go:106

My configuration is as follows:

filebeat.inputs:
    - type: log
      paths:
        - /<PATH>
      processors:
        - decode_xml:
            field: message
            target_field: "xml"
            overwrite_keys: true

....

2

Hi @Francisco_Peralta_Gu , try 7.12, that's when it was introduced.

The docs for 7.11 do not mention decode_xml. Define processors | Filebeat Reference [7.11] | Elastic

1 Like
4

Thank you @andrewkroh .
Trying with 7.12 version I am getting the following error:

 instance/beat.go:971    Exiting: Failed to start crawler: starting input failed: Error while initializing input: missing fields option in filebeat.inputs.0.processors.0.decode_xml
Exiting: Failed to start crawler: starting input failed: Error while initializing input: missing fields option in filebeat.inputs.0.processors.0.decode_xml

This is the configuration of my input

   filebeat.inputs:
    - type: log
      paths:
        - /dumps/**
      processors:
        - decode_xml:
            field: message
            target_field: xml
            ignore_missing: true
            ignore_failure: true
5

Once I activated the debug mode I cannot see more info that I include below:

2021-04-06T07:02:44.851Z	INFO	[monitoring]	log/log.go:152	Total non-zero metrics	{"monitoring": {"metrics": {"beat":{"cgroup":{"cpu":{"cfs":{"period":{"us":100000},"quota":{"us":400000}},"id":"crio-68f84aa9cf563e928781488cefeae8870012bea8879bb84507933164a1a2f420.scope","stats":{"periods":2}},"cpuacct":{"id":"crio-68f84aa9cf563e928781488cefeae8870012bea8879bb84507933164a1a2f420.scope","total":{"ns":180222497}},"memory":{"id":"crio-68f84aa9cf563e928781488cefeae8870012bea8879bb84507933164a1a2f420.scope","mem":{"limit":{"bytes":1073741824},"usage":{"bytes":44670976}}}},"cpu":{"system":{"ticks":50,"time":{"ms":56}},"total":{"ticks":140,"time":{"ms":149},"value":140},"user":{"ticks":90,"time":{"ms":93}}},"handles":{"limit":{"hard":1048576,"soft":1048576},"open":8},"info":{"ephemeral_id":"1030b8cd-8c29-463a-bd66-5df3c6973349","uptime":{"ms":86}},"memstats":{"gc_next":18425648,"memory_alloc":16343096,"memory_sys":76366848,"memory_total":52962720,"rss":84951040},"runtime":{"goroutines":11}},"filebeat":{"harvester":...
2021-04-06T07:02:44.851Z	INFO	[monitoring]	log/log.go:153	Uptime: 87.107058ms
2021-04-06T07:02:44.851Z	INFO	[monitoring]	log/log.go:130	Stopping metrics logging.
2021-04-06T07:02:44.851Z	INFO	instance/beat.go:474	filebeat stopped.
2021-04-06T07:02:44.851Z	ERROR	instance/beat.go:971	Exiting: Failed to start crawler: starting input failed: Error while initializing input: missing fields option in filebeat.inputs.0.processors.0.decode_xml
Exiting: Failed to start crawler: starting input failed: Error while initializing input: missing fields option in filebeat.inputs.0.processors.0.decode_xml

Please could you tell me if there is there any configuration mistake, bug or anything else?

6

Hi.
Please we need information about if the configuration is applied right or if this is an issue of the module decode_xml.

Thank you!

7

Hello @Francisco_Peralta_Gu , this has confirmed to be a bug, and will be resolved in 7.13 and 7.12.2 releases unless something changes.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.