Transform input before multiline processing?

Thanks for looking at my question.

I am using the TCP input to receive XML data from a remote host, which I am parsing into XML stanzas using multiline. This works pretty well.

Unfortunately, the remote host (which I do not control) occasionally sends me broken xml line this:

<CurrentSummationDelivered> \r\n

Note that last closing tag. The newline is in the wrong place. This breaks my current multiline configuration:

codec => multiline {
  pattern => "<CurrentSummationDelivered>"
  negate => "true"
  what => "previous"

When this condition occurs, it is regularly broken in exactly this way.

I'd like the "fix up" this input on the receiving end (because I have no control of the sending side). What approaches might I use to do this in the input, before the XML processing?


pattern can be a regular expression. Are you able to construct a regexp that always matches?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.