# Issue with XML filter - xmlparsefailure

**URL:** <https://discuss.elastic.co/t/issue-with-xml-filter-xmlparsefailure/66159>\
**Category:** Logstash\
**Created:** [November 15, 2016, 7:20pm UTC](https://discuss.elastic.co/t/issue-with-xml-filter-xmlparsefailure/66159 "2016-11-15T19:20:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lazypete](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Lazypete](https://discuss.elastic.co/u/Lazypete)\
**Post date:** [November 15, 2016, 7:20pm UTC](https://discuss.elastic.co/t/issue-with-xml-filter-xmlparsefailure/66159/1 "2016-11-15T19:20:01Z")

</div>

Ok I'm trying to use LEK (logstash, elasticsearch, kibana) to parse and display logs from a IBM datapower appliance.

My problem is that whatever XML I send to logstash all I get is  
The unformatted data and this beauty at the end

"tags":["\_xmlparsefailure"]

So I checked the log file for logstash and found a corresponding error message

:exception=\># NoMethodError: undefined method `start\_with?' for nil:NilClass,  
[it then goes on with a stack trace]

What I am wondering, is this happening because the XML I sent were invalid or do I have something broken in my installation?  
(of ruby I guess since the files in the stack trace were .rb files)

Thanx to anyone who can help.

Here is the stack trace (I have changed some paths to relative but they were all absolute)

:exception=\>#NoMethodError: undefined method `start_with?' for nil:NilClass, :backtrace=>[".../logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.0-java/lib/logstash/event.rb:140:in`[]='", ".../logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-2.0.2/lib/logstash/filters/xml.rb:130:in `filter'", ".../logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.0-java/lib/logstash/filters/base.rb:151:in`multi\_filter'", "org/jruby/RubyArray.java:1613:in `each'", ".../logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.0-java/lib/logstash/filters/base.rb:148:in`multi\_filter'", "(eval):45:in `filter_func'", ".../logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.0-java/lib/logstash/pipeline.rb:243:in`filterworker'", ".../logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.0-java/lib/logstash/pipeline.rb:177:in `start\_filters'"], :level=\>:warn}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 15, 2016, 7:33pm UTC](https://discuss.elastic.co/t/issue-with-xml-filter-xmlparsefailure/66159/2 "2016-11-15T19:33:10Z")

</div>

If the xml filter's `store_xml` option is true you have to set the `target` option.

---

<div class="post-metadata">

**Author:** ![Lazypete](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Lazypete](https://discuss.elastic.co/u/Lazypete)\
**Post date:** [November 16, 2016, 12:27pm UTC](https://discuss.elastic.co/t/issue-with-xml-filter-xmlparsefailure/66159/3 "2016-11-16T12:27:25Z")

</div>

Oh well guess it was a newbies mistake.

I didnt think I needed target, then I realized store\_xml is true by default.

Thank for your help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2016, 12:27pm UTC](https://discuss.elastic.co/t/issue-with-xml-filter-xmlparsefailure/66159/4 "2016-12-14T12:27:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.