I want to ingest XML files to the ELK-Stack. I want one event per XML file. These XML files end without line feed, thus filebeat's multiline codec never forwards the last line of the XML to Logstash. Because of this Logstash's XML filter is then not able to parse the XML correctly.
I'm using filebeat 5.2.1.
My XML's look like this (I inserted line feeds (LF) to show):
LF <taskReport>LF LF <toplevelinfo Error="0" Warning="0"/>LF LF </taskReport>
My filebeat.yml looks like this:
filebeat.prospectors: - paths: - C:\*.xml input_type: log document_type: xml multiline: pattern: '^<taskReport>' negate: true match: after output.logstash: hosts: ["LS:5044"]
Is there an option in filebeat to send this last line within the event?
If I manually add a line feed at the end of the XML logstash can perfectly parse the XML, but this is not an option to me.
Thanks in advance,