Hi @Badger
I configured mutate and xml, but I'm receveid this error:
:exception=>#<REXML::ParseException: missing attribute quote Line: 1 Position: 62576 Last 80 unconsumed characters:
My config:
filter { mutate { gsub => ["message", "</xml>$", ""] } }
filter { xml { source => "message" store_xml => true target => "theXML" force_array => false } }
The index is created on Elasticsearch, but all fields without field message
Like this:
"_index" : "teste-2018.08", "_type" : "doc", "_id" : "_1FW9mQBCtVZHh-PRMtz", "_score" : 1.0, "_source" : { "tags" : [ "_xmlparsefailure" ], "@timestamp" : "2018-08-01T16:33:22.758Z", "@version" : "1", "message" : "<?xml version=\\\"1.0\\\" encoding=\\\"ISO-8859-1\\\"?><FAT ...