Parse Exception NoMethodDefined

What should we do if raw xml log contains nil value, logstash throws exception like

> [[main]>worker0] xml - Error parsing xml with XmlSimple {:source=>"message", :value=>"<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>Information</Level><Task>None</Task><Opcode></\\nOpcode><Keywords>Classic</Keywords><TimeCreated SystemTime='2020-02-01T00:55:45.040458400Z'/><EventRecordID>296447</EventRecordID><Correlation/><Execution ProcessID='712' ThreadID='6072'/><Channel>System</Channel><Computer>Tabc.local</Computer><Security/></System><EventData>The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.</EventData></Event>", :exception=>#<REXML::ParseException: #<NoMethodError: undefined method ' for nil:NilClass>`

Here opecode </\nOpcode> is reason of this exception. I'm using XML filter and getting parsed data using xpack, if I remove the opcode </\nOpcode> from the raw log then my logstash conf works ok.

What should I do in this case?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.