Logstash XML Parser Fail - File Does Not Exist?

After upgrading logstash to 5.6.5 I am know getting the following error en masse and don't understand what the error is trying to tell me.

Snip of logstash config for xml section:

            xml {
                source => "sub-message"
                store_xml => true
                target => "parsed_xml"
                remove_field => [ "[parsed_xml][Appliance]", "[parsed_xml][Company]", "[parsed_xml][HostName]", "[parsed_xml][Priority]", "[parsed_xml][Version]" ]
                id => "SA-xml-1"
                add_tag => "xml-parse"
            }

Which results in the error below:

[2017-12-12T10:38:15,682][WARN ][logstash.filters.xml     ] Error parsing xml with XmlSimple {:source=>"sub-message", :value=>"SecureAuth14[10436] After sending OTP with: OTPHtmlEmailProvider", :exception=>#<ArgumentError: File does not exist: SecureAuth14[10436] After sending OTP with: OTPHtmlEmailProvider.>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/xml-simple-1.1.5/lib/xmlsimple.rb:996:in `find_xml_file'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/xml-simple-1.1.5/lib/xmlsimple.rb:168:in `xml_in'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/xml-simple-1.1.5/lib/xmlsimple.rb:203:in `xml_in'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-xml-4.0.5/lib/logstash/filters/xml.rb:182:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in `multi_filter'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:46:in `multi_filter'", "(eval):6971:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):6965:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):6998:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):6994:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):1502:in `filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:398:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:379:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `start_workers'"]}

Not 100% sure of this, but after doing a bit more review, it looks like the log data that was coming in XML switched at a certain point to regular text. So the XML filter basically had nothing to do since the data in the 'sub-message' field was not XML formatted.

ArgumentError: File does not exist I interpret as trying to tell me this in case this helps anyone else out.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.