Hey all, new to logstash.
I'm running into an error when trying to parse an empty xml element.
failed to parse field [xml.record.person.agedata.dob] of type [text] in document with id 'DA9jvH8BhCQVGJZR4sKN'. Preview of field's value: '{nil=true}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:990"
Here's an example XML message:
<entry>
<person>
<title xsi:nil="true"/>
<job xsi:nil="true"/>
<names>
<first_name>John</first_name>
<last_name>Doe</last_name>
</names>
<ageinfo>
<dob xsi:nil='true'/>
</ageinfo>
</person>
</entry>
And my config
input {
beats {
port => 5044
}
}
filter {
if [message] =~ /<\?xml/ { drop {} }
xml {
namespaces => {
"xsi" => "http://www.w3.org/2001/XMLSchema-instance"
"xsd" => "http://www.w3.org/2001/XMLSchema"
"xmlns" => "http://www.w3.org/2001/XMLSchema"
}
store_xml => false
source => "message"
target => "doc"
force_array => true
xpath =>
[
"/entry/person/title/text()", "title",
"/entry/person/job/text()", "job",
"/entry/person/position/text()", "position",
"/entry/person/names/first_name/text()", "firstName",
"/entry/person/names/last_name/text()", "lastName",
"/entry/person/agedata/dob/text()", "dob",
]
}
mutate {
remove_field => ["@version","beat","count","fields","input_type","offset","type","host","tags","path","log"]
}
}
output {
elasticsearch {
hosts => ["elasticsearch:9200"]
index => "test3"
}
stdout { codec => rubydebug {metadata => true} }
}
Version 7.14