XML parsing error: <RuntimeError: entity expansion has grown too large>

Elastic Stack Logstash
1

I'm trying to parse XML file that has 40000 lines as one event.

Error at logstash:
<RuntimeError: entity expansion has grown too large>

Filebeat:

  multiline.pattern: '^<?xml '
  multiline.match: after
  multiline.negate: true
  multiline.max_lines: 100000

Logstash:

       xml {
                    source => "message"
                    #store_xml => "false"
                    target => "xmldata"
#                       xpath => [
#                               "//Report/@name", "report_name",
#                               "//Policy/policyName", "policyName",
#                               "//ReportItem/description", "description"
#                       ]
                    #remove_namespaces => true
            }
            mutate  {
                    remove_field => [ "message" ]
            }

Can i increase REXML limits?
Am i doing something wrong?
Can i have the same result in another way (large xml file as one event) ?

Tnks

EDIT:
this machine has 32gb ram
I'v tried export LS_HEAP_SIZE=10g, without success
XML File has 2,5Mb

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.