# XML - Illegal Argument Exception

**URL:** <https://discuss.elastic.co/t/xml-illegal-argument-exception/313704>\
**Category:** Logstash\
**Created:** [September 5, 2022, 5:18pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704 "2022-09-05T17:18:49Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![hnf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hnf/32/109840_2.png) [@hnf](https://discuss.elastic.co/u/hnf)\
**Post date:** [September 5, 2022, 5:18pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704/1 "2022-09-05T17:18:49Z")

</div>

Hello Everyone,

I'm unable to dissect my xml file. I'm getting some error of `"error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [CELL] cannot be changed from type [text] to [ObjectMapper]"}`. Please find below my .conf file

```auto
input
{
        file
        {
                path => "/home/admin/*_CSSR.xml"
                codec => multiline
                {
                        pattern => "^<moid*>"
                        negate => "true"
                        what => "previous"
                }
        }
}

filter
{
        xml
        {
                source => "message"
                store_xml => true
                target => "parsed"
        }

        dissect { mapping =>
                {
                        "message" => '<moid>%{BSC}/GCELL:LABEL=%{CELL}, CellIndex=%{CellIndex}, CGI=%{CGI}</moid>
<r>%{CELL.ASS.SUCC.RATE}</r>
<r>%{CELL.BSS.CALL.ESTB.SUCC.RATE}</r>
<r>%{CELL.CALL.ESTB.SUCC.RATE}</r>
<r>%{CELL.ESTB.IND.SUCC.RATE.IMM.ASS}</r>
<r>%{CELL.SD.CALL.DROP}</r>
%{?lereste}<mv>' }
        }
}

```

Here is the errors messages:

```auto
[WARN] 2022-09-05 16:39:10.714 [[main]>worker7] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"xml-05-09-2022", :routing=>nil}, {"BSC"=>"BSC04_KANKAN", "CELL"=>"MAN22471D", "CGI"=>"611019C44608A", "CELL.BSS.CALL.ESTB.SUCC.RATE"=>"98.031", "CELL.ASS.SUCC.RATE"=>"100", "tags"=>["multiline", "_xmlparsefailure"], "log"=>{"file"=>{"path"=>"/home/admin/HOST04_pmresult_60_202209051500_202209051600_CSSR.xml"}}, "host"=>{"name"=>"ogn-poc-uat-aiml-cam"}, "message"=>"<moid>BSC04_KANKAN/GCELL:LABEL=MAN22471D, CellIndex=449, CGI=611019C44608A</moid>\n<r>100</r>\n<r>98.031</r>\n<r>92.857</r>\n<r>98.031</r>\n<r>0</r>\n<sf>false</sf>\n</mv>\n<mv>", "@timestamp"=>2022-09-05T16:39:09.689004Z, "event"=>{"original"=>"<moid>BSC04_KANKAN/GCELL:LABEL=MAN22471D, CellIndex=449, CGI=611019C44608A</moid>\n<r>100</r>\n<r>98.031</r>\n<r>92.857</r>\n<r>98.031</r>\n<r>0</r>\n<sf>false</sf>\n</mv>\n<mv>"}, "@version"=>"1", "CELL.CALL.ESTB.SUCC.RATE"=>"92.857", "CELL.ESTB.IND.SUCC.RATE.IMM.ASS"=>"98.031", "CELL.SD.CALL.DROP"=>"0", "CellIndex"=>"449"}], :response=>{"index"=>{"_index"=>"xml-05-09-2022", "_id"=>"gM-FDoMB5KKfgEMDJsEl", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [CELL] cannot be changed from type [text] to [ObjectMapper]"}}}}
[WARN] 2022-09-05 16:39:11.853 [[main]>worker5] xml - Error parsing xml with XmlSimple {:source=>"message", :value=>"<moid>BSC04_KANKAN/GCELL:LABEL=KER22464A, CellIndex=262, CGI=611019C4A6041</moid>\n<r>100</r>\n<r>98.305</r>\n<r>91.304</r>\n<r>98.305</r>\n<r>0</r>\n<sf>false</sf>\n</mv>\n</mi>\n</md>\n<mff>\n<ts>202209051600</ts>\n</mff>\n</mdc>", :exception=>#<REXML::ParseException: #<RuntimeError: attempted adding second root element to document>
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/document.rb:197:in `add'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/element.rb:1931:in `add'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/child.rb:22:in `initialize'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/parent.rb:14:in `initialize'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/element.rb:328:in `initialize'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/element.rb:1929:in `add'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/element.rb:733:in `add_element'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/document.rb:210:in `add_element'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/parsers/treeparser.rb:34:in `parse'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/document.rb:448:in `build'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/document.rb:101:in `initialize'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:979:in `parse'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:164:in `xml_in'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:203:in `xml_in'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-xml-4.1.3/lib/logstash/filters/xml.rb:195:in `filter'
/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'
/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'
org/jruby/RubyArray.java:1821:in `each'
/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'
org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'
/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:300:in `block in start_workers'
...
attempted adding second root element to document
Line: 2
Position: 85
Last 80 unconsumed characters:
>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/parsers/treeparser.rb:96:in `parse'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/document.rb:448:in `build'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/document.rb:101:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:979:in `parse'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:164:in `xml_in'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:203:in `xml_in'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-xml-4.1.3/lib/logstash/filters/xml.rb:195:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1821:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:300:in `block in start_workers'"]}

```

Because the pattern is repeated (as it is xml file), I see the `ParseException`, saying : `#<RuntimeError: attempted adding second root element to document>` .  
I don't know how to fix this issue.

Your help is really appreciate.  
Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 5, 2022, 6:25pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704/2 "2022-09-05T18:25:34Z")

</div>

> [@hnf](#):
>
> #\<RuntimeError: attempted adding second root element to document

That is saying that there are more than one root elements in the document you are trying to parse. The xml filter cannot support that. Looking at your message....

> [@hnf](#):
>
> ```auto
> <moid>BSC04_KANKAN/GCELL:LABEL=KER22464A, CellIndex=262, CGI=611019C4A6041</moid>\n<r>100</r>\n<r>98.305</r>\n<r>91.304</r>\n<r>98.305</r>\n<r>0</r>\n<sf>false</sf>\n</mv>\n</mi>\n</md>\n<mff>\n<ts>202209051600</ts>\n</mff>\n</mdc>
> 
> ```

You have the root element \<moid\>, followed by multiple additional root elements \<r\>, followed by root element \<sf\> etc. You could wrap everything in an additional element.

```
mutate {
    gsub => [
        "message", "^", "<foo>", 
        "message", "$", "</foo>"
    ]
}

```

Then you will have a single root element \<foo\>.

---

<div class="post-metadata">

**Author:** ![hnf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hnf/32/109840_2.png) [@hnf](https://discuss.elastic.co/u/hnf)\
**Post date:** [September 5, 2022, 8:19pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704/3 "2022-09-05T20:19:32Z")

</div>

Thanks a lot for your reply.

I tried your solution but I have almost same issue.

Here the errors messages:

```auto
[WARN] 2022-09-05 19:10:28.711 [[main]>worker7] Dissector - Dissector mapping, pattern not found {"field"=>"message", "pattern"=>"<moid>%{BSC}/GCELL:LABEL=%{CELL}, CellIndex=%{CellIndex}, CGI=%{CGI}</moid>\n<r>%{CELL.ASS.SUCC.RATE}</r>\n<r>%{CELL.BSS.CALL.ESTB.SUCC.RATE}</r>\n<r>%{CELL.CALL.ESTB.SUCC.RATE}</r>\n<r>%{CELL.ESTB.IND.SUCC.RATE.IMM.ASS}</r>\n<r>%{CELL.SD.CALL.DROP}</r>\n%{?lereste}<mv>", "event"=>{"@timestamp"=>2022-09-05T19:10:25.282820Z, "tags"=>["multiline", "_xmlparsefailure", "_dissectfailure"], "message"=>"<global><moid>BSC04_KANKAN/GCELL:LABEL=MAN20675B, CellIndex=309, CGI=611019C481A60</moid></global>\n<global><r>99.711</r></global>\n<global><r>94.104</r></global>\n<global><r>82.933</r></global>\n<global><r>94.439</r></global>\n<global><r>0.066</r></global>\n<global><sf>false</sf></global>\n<global></mv></global>\n<global><mv></global>", "event"=>{"original"=>"<moid>BSC04_KANKAN/GCELL:LABEL=MAN20675B, CellIndex=309, CGI=611019C481A60</moid>\n<r>99.711</r>\n<r>94.104</r>\n<r>82.933</r>\n<r>94.439</r>\n<r>0.066</r>\n<sf>false</sf>\n</mv>\n<mv>"}, "log"=>{"file"=>{"path"=>"/home/admin/HOST04_pmresult_60_202209051700_202209051800_CSSR.xml"}}, "host"=>{"name"=>"ogn-poc-uat-aiml-cam"}, "@version"=>"1"}}
[WARN] 2022-09-05 19:10:28.711 [[main]>worker5] xml - Error parsing xml with XmlSimple {:source=>"message", :value=>"<moid>BSC04_KANKAN/GCELL:LABEL=MAN22477C, CellIndex=404, CGI=611019C4160C5</moid>\n<r>100</r>\n<r>100</r>\n<r>96.053</r>\n<r>100</r>\n<r>0</r>\n<sf>false</sf>\n</mv>\n<mv>", :exception=>#<REXML::ParseException: #<RuntimeError: attempted adding second root element to document>
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/document.rb:197:in `add'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/element.rb:1931:in `add'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/child.rb:22:in `initialize'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/parent.rb:14:in `initialize'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/element.rb:328:in `initialize'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/element.rb:1929:in `add'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/element.rb:733:in `add_element'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/document.rb:210:in `add_element'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/parsers/treeparser.rb:34:in `parse'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/document.rb:448:in `build'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/rexml-3.2.5/lib/rexml/document.rb:101:in `initialize'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:979:in `parse'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:164:in `xml_in'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:203:in `xml_in'
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-xml-4.1.3/lib/logstash/filters/xml.rb:195:in `filter'
/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'
/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'
org/jruby/RubyArray.java:1821:in `each'
/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'
org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'
/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:300:in `block in start_workers'
...
attempted adding second root element to document
Line: 2
Position: 85

```

Any idea?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 5, 2022, 8:51pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704/4 "2022-09-05T20:51:44Z")

</div>

> [@hnf](#):
>
> ```auto
> :source=>"message", :value=>"<moid>BSC04_KANKAN/GCELL:LABEL=MAN22477C, CellIndex=404, CGI=611019C4160C5</moid>\n<r>100</r>\n<r>100</r>\n<r>96.053</r>\n<r>100</r>\n<r>0</r>\n<sf>false</sf>\n</mv>\n<mv>"
> 
> ```

The value of the [message] field has not changed, so you will get the same errors. Did you add the mutate filter _before_ the xml filter?

---

<div class="post-metadata">

**Author:** ![hnf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hnf/32/109840_2.png) [@hnf](https://discuss.elastic.co/u/hnf)\
**Post date:** [September 6, 2022, 8:43am UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704/5 "2022-09-06T08:43:45Z")

</div>

> The value of the [message] field has not changed, so you will get the same errors. Did you add the mutate filter _before_ the xml filter?

Yes, I did this manner, but I think it is also inserting my global wrapper as you can see on the first line of the output shared up. Why the `message=>` on the first two line are differente from the value.

I notice on the 1st line that the `"message" =>` is different from the value you pointed out while trying to parse. Why this kind of behoviour or i'm misunderstanding.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 6, 2022, 3:46pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704/6 "2022-09-06T15:46:39Z")

</div>

> [@hnf](#):
>
> Why the `message=>` on the first two line are differente from the value.

Impossible to say without seeing your configuration.

---

<div class="post-metadata">

**Author:** ![hnf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hnf/32/109840_2.png) [@hnf](https://discuss.elastic.co/u/hnf)\
**Post date:** [September 7, 2022, 12:51pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704/7 "2022-09-07T12:51:33Z")

</div>

Hello @Badger ,  
I made many work arround but nothing work. I made a little change in the conf file and getting some error as shown in [this txt file](https://drive.google.com/file/d/1SkK0mREFfnQ2VsYRvHts6pKEborpdvHY/view?usp=sharing).

[Here](https://drive.google.com/file/d/1SsNKEbt5Wzh4ynwAx4kUIEQXdyPwvTqq/view?usp=sharing) is my actual .conf file

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![hnf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hnf/32/109840_2.png) [@hnf](https://discuss.elastic.co/u/hnf)\
**Post date:** [September 9, 2022, 3:31pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704/8 "2022-09-09T15:31:17Z")

</div>

Hello @Badger ,

Until now I don't know how to get out from this xml issue. have you get some time for what I shared.

Best Regards.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 9, 2022, 4:05pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704/9 "2022-09-09T16:05:51Z")

</div>

There are two different errors in that log.

> xml - Error parsing xml with XmlSimple {:source=\>"message", :value=\>"\<?xml version=\"1.0\" encoding=\"UTF-8\"?\>\n\n\n202209071000\n\n\n\n202209071000\n60\nCELL.ASS.SUCC.RATE\nCELL.BSS.CALL.ESTB.SUCC.RATE\nCELL.CALL.ESTB.SUCC.RATE\nCELL.ESTB.IND.SUCC.RATE.IMM.ASS\nCELL.SD.CALL.DROP", :exception=\>#\<REXML::ParseException: No close tag for /mdc/md/mi

As it says, the \<mi\> element is never closed.

The second error is

> Dissector - Dissector mapping, pattern not found {"field"=\>"message", "pattern"=\>"\n%{BSC}/GCELL:LABEL=%{CELL}, CellIndex=%{CellIndex}, CGI=%{CGI}\n%{CELL.ASS.SUCC.RATE}\n%{CELL.BSS.CALL.ESTB.SUCC.RATE}\n%{CELL.CALL.ESTB.SUCC.RATE}\n%{CELL.ESTB.IND.SUCC.RATE.IMM.ASS}\n%{CELL.SD.CALL.DROP}\n%{}\n", "event"=\>{"event"=\>{"original"=\>"\nBSC04\_KANKAN/GCELL:LABEL=KRS20705A, CellIndex=526, CGI=611019C4C1B8B\n100\n96.848\n98.802\n96.848\n0\nfalse\n"}, "message"=\>{"sf"=\>["false"], "moid"=\>["BSC04\_KANKAN/GCELL:LABEL=KRS20705A, CellIndex=526, CGI=611019C4C1B8B"], "r"=\>["100", "96.848", "98.802", "96.848", "0"]}

In this case the xml has successfully parsed and overwritten the [message] field, so the dissect pattern does not match it.

---

<div class="post-metadata">

**Author:** ![hnf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hnf/32/109840_2.png) [@hnf](https://discuss.elastic.co/u/hnf)\
**Post date:** [September 9, 2022, 4:17pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704/10 "2022-09-09T16:17:40Z")

</div>

OK. Noted!!! And thank a lot for your time.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 7, 2022, 4:18pm UTC](https://discuss.elastic.co/t/xml-illegal-argument-exception/313704/11 "2022-10-07T16:18:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.