But on Kibana Discover I can see all data inside one line and the second line is not parsed.
I would like to see 2 different documents, the first one for "Hotel 1" and second one for "Hotel 2", with same fields: Name, Rooms, Kitchens and Restaurants (but different values).
Question, are those lines within a larger XML document or completely separate / independent lines?
If they are within a single document, can you show us the enclosing XML?
If they are separate lines, is there a carriage return/ line feed after the second line to make sure it gets processed
EDIT I just ran your conf assuming those were separate / independent lines and it worked and I got both lines process if there is a newline after the 2nd line ... if not I only got 1 line.
Hi @stephenb , thanks a lot for your help and also for the test!!
Yes, I have both of tags inside the same line. There is no character (like "\r" "\n" or anything else) that would allow me to select a new line. Can I still parse it as 2 separate lines? I don't know if it's nonsense, but online I found the "multiline" plugin (but I think I have not configured well)
You cannot have two XML documents on the same line. The xml filter should be logging "attempted adding second root element to document". You can split it into two lines using
If the file has the elements on two separate lines then you do not need the mutate and split. If you do need the mutate then you need that literal newline embedded in the replacement string.
@Ely_96 Put a return / newline after the second line...
Logstash reads files line by line... since no newline on 2nd line it will not process it until there is a newline.... because until a newline the current line may not be finished being written too...
I can see there is no newline at the end on line 2... put one in... and it will work
But the pipeline should be able to load an xml received by filebeat, so now I insert a new line after the last one, but when the process is active I will not be able to insert manually a new line. Can I handle this in any way?
Whatever process is writing that file needs to end the last line with a newline...
Filebeat is also "Line Oriented" until a line has a newline at the end... that line is not finished... that is pretty common in any line oriented processing.
Thanks a lot for your answer!!
Probably the colleague who gave me the first log only made copy / paste of the two lines without paying attention to the last empty line.
I will check it
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.