Multiline codec produces ParseException: No close tag for /Events


I am ingesting an XML file that looks like this:

<Event xmlns="">  - about 630,000 of these events
  ... stuff

The input section of my config file looks like this:

input {
  file {
    path => "c:/traces/pcbd/20200327/wininettrace.xml"
    start_position => "beginning"
    sincedb_path => "NUL"
    type => "wininet"
    codec => multiline {
      pattern => "<Event "
      negate => true
      what => "previous"

The ingestion runs to completion, but right at the start I get this error:

Error parsing xml with XmlSimple {:source=>"message", :value=>"<Events>\r", :exception=>#<REXML::ParseException: No close tag for /Events

What do I need to do to get the multiline codec to ignore the <Events> and </Events> tags?

I would include them, then if you really need to (and I don't see why you would) you can mutate+gsub them away.

OK - but it causes a parsing error when the multiline codec runs. Perhaps I should rephrase my question:

How to I stop the parsing error?

If you are using xpath then you need the XML to be valid XML, it will not tolerate junk surrounding the XML (this is not true if you set store_xml to be true and save the parsed XML in the event). So you can either change the multiline codec so that it match '<Events>' rather than '<Event ', or you can use mutate+gsub to clean up the XML before passing it to the xml filter.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.