Logstash Error - RuntimeError: entity expansion has grown too large

I've a lot of xml-file containing log events and some of them are pretty large.

I'm trying to parse them with Logstash, but when the xml is too large, I get an xmlparsefailure and I got this error:

RuntimeError: entity expansion has grown too large.

Have you any idea to what can I do to handle this?

Thank you!

The XML parser has a limit of 10 KB for the maximum size of an entity substitution. This was introduced to protect against denial of service attacks.

The parser itself allow you to increase REXML::Document.entity_expansion_text_limit, but logstash does not provide a way to set that.

1 Like

Thank you Badger!!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.