Logstash XML parsing failure due to no namespace defined

Elastic Stack Logstash
1

Hello,

I would like to store XMLs in elastic, so when I give "store_xml => true", I get a parsing exception because my whole XML is wrapped by a tag "<C:Message>" and the prefix "C" is not having any definition unfortunately (I know it is wrong implementation but the centralized logging framework is adding this parent tag, so would not be able to change). Now to overcome this, is there any solution such as add namespace or remove a particular prefix as such? I do not want to remove all the prefixes present in the document.

Sample XML:

<C:Message>
<Date>03-05-2020</Date>
<Time>11:00:34</Time>
<SOAP-ENV:Body>
<Customer>2432532</Customer>
</SOAP-ENV:Body>
</C:Message>

Cheers,
Maadavan

2

Logstash Team,

Help or suggestions required here. Kindly do.

Cheers,
Maadavan

3

You could use mutate+gsub to remove those.

4

@Badger,

Thanks a lot, your solution worked for replacing the necessary contents. However facing another exception while parsing huge XMLs. Have opened a new topic for the same. Marking your answer as solution.

https://discuss.elastic.co/t/logstash-throws-runtime-exception-while-parsing-huge-xml/231621

Cheers,
Maadavan

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.