Issues parsing xml data

(Josh Speer) #1

I've setup a filter to try to split an XML and assign the fields to fields I can use but the split isn't working.

I'm using http_poller to pull the following xml file over

<?xml version="1.0" encoding="UTF-8"?><df:Feed xmlns:df="" 
xmlns:xsi="" Concept="EX">
<df:Name>Product 1 Name</df:Name>
<df:Name>Product 2 Name</df:Name>

Here is the error that I'm receiving

#<REXML::UndefinedNamespaceException: Undefined prefix df found>

Here is the input/filter of my config

input {
  http_poller {
    urls => {
        url => ""

    request_timeout => 10
    interval => 10

    codec => multiline {
      pattern => "^\<df\:Sku\>"
      negate => "true"
      what => "previous"

filter {
if [log_type] == "xmllog" {

xml {
    source => "message"
    target => "parsed"
    remove_namespaces => true
    store_xml => true
    force_array => true
    xpath => [

I've tried escaping the df: fields

field => "[parsed][df\:Sku]"

I'm able to separate the fields how I would like, however each filter request is throwing the undefined prefix error in the logs, throwing an xmlparsefailure.

(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.