# Multiline codec produces ParseException: No close tag for /Events

**URL:** <https://discuss.elastic.co/t/multiline-codec-produces-parseexception-no-close-tag-for-events/226010>\
**Category:** Logstash\
**Created:** [April 1, 2020, 8:50am UTC](https://discuss.elastic.co/t/multiline-codec-produces-parseexception-no-close-tag-for-events/226010 "2020-04-01T08:50:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paul\_Offord](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_offord/32/65261_2.png) [@Paul\_Offord](https://discuss.elastic.co/u/Paul_Offord)\
**Post date:** [April 1, 2020, 8:50am UTC](https://discuss.elastic.co/t/multiline-codec-produces-parseexception-no-close-tag-for-events/226010/1 "2020-04-01T08:50:50Z")

</div>

Hi,

I am ingesting an XML file that looks like this:

```auto
<Events>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - about 630,000 of these events
  ... stuff
</Event>
</Events>

```

The input section of my config file looks like this:

```auto
input {
  file {
    path => "c:/traces/pcbd/20200327/wininettrace.xml"
    start_position => "beginning"
    sincedb_path => "NUL"
    type => "wininet"
	
    codec => multiline {
      pattern => "<Event "
      negate => true
      what => "previous"
    }
  }
}

```

The ingestion runs to completion, but right at the start I get this error:

```auto
Error parsing xml with XmlSimple {:source=>"message", :value=>"<Events>\r", :exception=>#<REXML::ParseException: No close tag for /Events

```

What do I need to do to get the multiline codec to ignore the `<Events>` and `</Events>` tags?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 1, 2020, 3:16pm UTC](https://discuss.elastic.co/t/multiline-codec-produces-parseexception-no-close-tag-for-events/226010/2 "2020-04-01T15:16:56Z")

</div>

> [@Paul\_Offord](#):
>
> What do I need to do to get the multiline codec to ignore the `<Events>` and `</Events>` tags?

I would include them, then if you really need to (and I don't see why you would) you can mutate+gsub them away.

---

<div class="post-metadata">

**Author:** ![Paul\_Offord](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_offord/32/65261_2.png) [@Paul\_Offord](https://discuss.elastic.co/u/Paul_Offord)\
**Post date:** [April 1, 2020, 3:42pm UTC](https://discuss.elastic.co/t/multiline-codec-produces-parseexception-no-close-tag-for-events/226010/3 "2020-04-01T15:42:15Z")

</div>

OK - but it causes a parsing error when the multiline codec runs. Perhaps I should rephrase my question:

How to I stop the parsing error?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 1, 2020, 4:20pm UTC](https://discuss.elastic.co/t/multiline-codec-produces-parseexception-no-close-tag-for-events/226010/4 "2020-04-01T16:20:22Z")

</div>

If you are using xpath then you need the XML to be valid XML, it will not tolerate junk surrounding the XML (this is not true if you set store\_xml to be true and save the parsed XML in the event). So you can either change the multiline codec so that it match '\<Events\>' rather than '\<Event ', or you can use mutate+gsub to clean up the XML before passing it to the xml filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2020, 4:20pm UTC](https://discuss.elastic.co/t/multiline-codec-produces-parseexception-no-close-tag-for-events/226010/5 "2020-04-29T16:20:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.