Transform input before multiline processing?

Elastic Stack Logstash
1

Thanks for looking at my question.

I am using the TCP input to receive XML data from a remote host, which I am parsing into XML stanzas using multiline. This works pretty well.

Unfortunately, the remote host (which I do not control) occasionally sends me broken xml line this:

<CurrentSummationDelivered> \r\n
  <DeviceMacId>0x00ff8d00001fe92a</DeviceMacId>\r\n  
  <TimeStamp>0x25291b44</TimeStamp>\r\n  
  <SummationDelivered>0x000000000517fe1c</SummationDelivered>\r\n  
</CurrentSummationDeli\nvered>\r

Note that last closing tag. The newline is in the wrong place. This breaks my current multiline configuration:

codec => multiline {
  pattern => "<CurrentSummationDelivered>"
  negate => "true"
  what => "previous"
}

When this condition occurs, it is regularly broken in exactly this way.

I'd like the "fix up" this input on the receiving end (because I have no control of the sending side). What approaches might I use to do this in the input, before the XML processing?

Thanks!

2

pattern can be a regular expression. Are you able to construct a regexp that always matches?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.