{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-xml/issues/10","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-xml/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-xml/issues/10/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-xml/issues/10/events","html_url":"https://github.com/logstash-plugins/logstash-filter-xml/issues/10","id":77092671,"number":10,"title":" xml filter xpath silent failure","user":{"login":"jordansissel","id":131818,"avatar_url":"https://avatars.githubusercontent.com/u/131818?v=3","gravatar_id":"","url":"https://api.github.com/users/jordansissel","html_url":"https://github.com/jordansissel","followers_url":"https://api.github.com/users/jordansissel/followers","following_url":"https://api.github.com/users/jordansissel/following{/other_user}","gists_url":"https://api.github.com/users/jordansissel/gists{/gist_id}","starred_url":"https://api.github.com/users/jordansissel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jordansissel/subscriptions","organizations_url":"https://api.github.com/users/jordansissel/orgs","repos_url":"https://api.github.com/users/jordansissel/repos","events_url":"https://api.github.com/users/jordansissel/events{/privacy}","received_events_url":"https://api.github.com/users/jordansissel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-16T18:01:22Z","updated_at":"2015-05-27T17:46:58Z","closed_at":null,"body":"(originally posted in https://github.com/elastic/logstash/issues/1688 by @SleeperSmith)\r\n\r\nThe offending line is at line 93:\r\nbegin\r\ndoc = Nokogiri::XML(value)\r\nrescue => e\r\nevent.tag(\"_xmlparsefailure\")\r\n@logger.warn(\"Trouble parsing xml\", :source => @source, :value => value,\r\n:exception => e, :backtrace => e.backtrace)\r\nreturn\r\nend\r\n\r\nWhen Nokogiri fails, it does not throw, but instead it puts the error into an \"errors\" property. So you need to check for doc.errors for parse failures.\r\n\r\nThis especially problematic in situation where Nokogiri fails to parse but XmlSimple succeeds. Logstash would pump out the log with the structure expanded but none of the xpath would work obviously. (The exact problem i encountered.) The offending character in my case was etc with error message \"#\".\r\n\r\nP.S. I don't do ruby, so I can't really do a bug fix and pull request.\r\n"},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-xml/issues/comments/106010428","html_url":"https://github.com/logstash-plugins/logstash-filter-xml/issues/10#issuecomment-106010428","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-xml/issues/10","id":106010428,"user":{"login":"rafaltrojniak","id":1113112,"avatar_url":"https://avatars.githubusercontent.com/u/1113112?v=3","gravatar_id":"","url":"https://api.github.com/users/rafaltrojniak","html_url":"https://github.com/rafaltrojniak","followers_url":"https://api.github.com/users/rafaltrojniak/followers","following_url":"https://api.github.com/users/rafaltrojniak/following{/other_user}","gists_url":"https://api.github.com/users/rafaltrojniak/gists{/gist_id}","starred_url":"https://api.github.com/users/rafaltrojniak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rafaltrojniak/subscriptions","organizations_url":"https://api.github.com/users/rafaltrojniak/orgs","repos_url":"https://api.github.com/users/rafaltrojniak/repos","events_url":"https://api.github.com/users/rafaltrojniak/events{/privacy}","received_events_url":"https://api.github.com/users/rafaltrojniak/received_events","type":"User","site_admin":false},"created_at":"2015-05-27T17:46:58Z","updated_at":"2015-05-27T17:46:58Z","body":"I belive I bumped in to this issue (was quite frustrating).\r\nWhen woring on https://discuss.elastic.co/t/xml-filter-help-required/1387 I tried that :\r\nEvent:\r\n```json\r\n{\"format\":\"xml_xpath\",\"message\":\"<stats><stats xmlns='jcs:stats:jsm'><current-online-user-count>1730</current-online-user-count><login-rate>0</login-rate><successful_logins>93645</successful_logins><failed_logins>84583</failed_logins><uptime>1900999</uptime></stats>\\n<stats xmlns='jcs:stats:delivery'><total-message-packets>5428196</total-message-packets><total-presence-packets>288328380</total-presence-packets><total-iq-packets>4977074</total-iq-packets><messages-in-last-time-slice>0</messages-in-last-time-slice><average-message-size>0</average-message-size></stats></stats>\"}\r\n```\r\nFilters:\r\n```\r\nfilter{\r\n  if [format] == \"xml_xpath\" {\r\n     xml {\r\n          source => \"message\"\r\n          target => \"message_parsed\"\r\n          add_tag => [\"xml_parsed\"]\r\n          xpath => [\r\n            \"/stats/stats/failed_logins/text()\", \"x_failed_logins\"\r\n            ]\r\n     }\r\n  }\r\n}\r\n```\r\nResult : no error, no x_failed_logins entry.\r\nWhen I had removed xmlns=.... params, The x_failed_logins appered.\r\n\r\nI was able to test it here :\r\nhttps://github.com/rafaltrojniak/logstash_rules/tree/xml_xpath\r\n\r\nPlease see the example inputs/outputs here. The first one(without xmlns) works, the second one (With xmlns) does not work\r\nhttps://github.com/rafaltrojniak/logstash_rules/blob/xml_xpath/doc.md#example-sources\r\n"}}