Trouble parsing xml file

[Miguel_Leite]

Hey there,
New to ELK and I was trying to parse the following xml file:

<msg time='2018-09-04T20:47:31.182+01:00' org_id='oracle' comp_id='rdbms'
 type='UNKNOWN' level='16' host_id='HHHHH'
 host_addr='XXX.XX.XXX.X' pid='YYYY' version='1'>
 <txt>Creating new log segment:
 </txt>
</msg>

I have the following logstash config file:

input {
        beats {
                port => 5044
        }
        if "xml" in [tags] {
                codec => multiline {
                        pattern => "<msg time"
                        negate => "true"
                        what => "next"
                }
        }
}
filter { 
       else if "xml" in [tags] {
                xml {
                        source => "message"
                        store_xml => false
                        xpath => [
                                   "/msg/text()", "msg_xml",
                                   "/msg/txt/text()", "txt_xml"
                        ]
                }
        }
}

Shouldn't it be working? The fields won't parse...

[balumurari1]

hope this helps you,

Unable to load xml file in logstash

The correct output is obtained for below input code, hope this helps other people, Also, max_lines number changes based on the maximum number of lines present in your xml file input { file { path => "C:/Users/LENOVO/Downloads/stations.xml" start_position => "beginning" sincedb_path => "NUL" codec => multiline { pattern => "^<?stations.*>" negate => "true" what => "previous" auto_flush_interval => 1 max_lines => 3000 } } } filter { xml { source => "message" target => "pars…

[wwalker (Walker)]

I believe your error is in your multiline codec config. You are saying if the pattern does not match <msg, stick it on the next line. So I think you're getting a bunch of <msg time='2018-09-04T20:47:31.182+01:00' org_id='oracle' comp_id='rdbms' lines with the rest of the relevant information being pushed down to the next line. Since it's not proper XML formatting, it probably throws a parsing error.

In the multiline codec config, change it to what => "previous". That changes it to, "If the line does not start with <msg time, stick it on the previous line."