Issue with XML filter - xmlparsefailure


(Patrick Ouellet) #1

Ok I'm trying to use LEK (logstash, elasticsearch, kibana) to parse and display logs from a IBM datapower appliance.

My problem is that whatever XML I send to logstash all I get is
The unformatted data and this beauty at the end

"tags":["_xmlparsefailure"]

So I checked the log file for logstash and found a corresponding error message

:exception=># NoMethodError: undefined method `start_with?' for nil:NilClass,
[it then goes on with a stack trace]

What I am wondering, is this happening because the XML I sent were invalid or do I have something broken in my installation?
(of ruby I guess since the files in the stack trace were .rb files)

Thanx to anyone who can help.

Here is the stack trace (I have changed some paths to relative but they were all absolute)

:exception=>#NoMethodError: undefined method start_with?' for nil:NilClass, :backtrace=>[".../logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.0-java/lib/logstash/event.rb:140:in[]='", ".../logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-2.0.2/lib/logstash/filters/xml.rb:130:in filter'", ".../logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.0-java/lib/logstash/filters/base.rb:151:inmulti_filter'", "org/jruby/RubyArray.java:1613:in each'", ".../logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.0-java/lib/logstash/filters/base.rb:148:inmulti_filter'", "(eval):45:in filter_func'", ".../logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.0-java/lib/logstash/pipeline.rb:243:infilterworker'", ".../logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.0-java/lib/logstash/pipeline.rb:177:in `start_filters'"], :level=>:warn}


(Magnus B├Ąck) #2

If the xml filter's store_xml option is true you have to set the target option.


(Patrick Ouellet) #3

Oh well guess it was a newbies mistake.

I didnt think I needed target, then I realized store_xml is true by default.

Thank for your help


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.