<div id="readability-page-1" class="page"><div id="post-body-8002049904769376545" itemprop="articleBody">

<div><pre><code>processors:&nbsp; - include_fields:&nbsp; &nbsp; &nbsp; fields: "message"&nbsp; - decode_xml:&nbsp; &nbsp; &nbsp; field: message&nbsp; &nbsp; &nbsp; target_field: ""</code></pre></div>
<div><pre><code>{&nbsp; "@timestamp": "2026-01-06T06:43:46.901Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "9.2.1"&nbsp; },&nbsp; "message": "Jan&nbsp; 5 03:12:34 rocky sysmon[947]: &lt;Event&gt;&lt;System&gt;&lt;Provider Name=\"Linux-Sysmon\" Guid=\"{ff032593-a8d3-4f13-b0d6-01fc615a0f97}\"/&gt;&lt;EventID&gt;5&lt;/EventID&gt;&lt;Version&gt;3&lt;/Version&gt;&lt;Level&gt;4&lt;/Level&gt;&lt;Task&gt;5&lt;/Task&gt;&lt;Opcode&gt;0&lt;/Opcode&gt;&lt;Keywords&gt;0x8000000000000000&lt;/Keywords&gt;&lt;TimeCreated SystemTime=\"2026-01-04T18:12:34.451516000Z\"/&gt;&lt;EventRecordID&gt;8660&lt;/EventRecordID&gt;&lt;Correlation/&gt;&lt;Execution ProcessID=\"947\" ThreadID=\"947\"/&gt;&lt;Channel&gt;Linux-Sysmon/Operational&lt;/Channel&gt;&lt;Computer&gt;rocky&lt;/Computer&gt;&lt;Security UserId=\"0\"/&gt;&lt;/System&gt;&lt;EventData&gt;&lt;Data Name=\"RuleName\"&gt;-&lt;/Data&gt;&lt;Data Name=\"UtcTime\"&gt;2026-01-04 18:12:34.454&lt;/Data&gt;&lt;Data Name=\"ProcessGuid\"&gt;{00000000-0000-0000-0000-000000000000}&lt;/Data&gt;&lt;Data Name=\"ProcessId\"&gt;2481&lt;/Data&gt;&lt;Data Name=\"Image\"&gt;&amp;lt;unknown process&amp;gt;&lt;/Data&gt;&lt;Data Name=\"User\"&gt;root&lt;/Data&gt;&lt;/EventData&gt;&lt;/Event&gt;",&nbsp; "event": {&nbsp; &nbsp; "system": {&nbsp; &nbsp; &nbsp; "channel": "Linux-Sysmon/Operational",&nbsp; &nbsp; &nbsp; "level": "4",&nbsp; &nbsp; &nbsp; "task": "5",&nbsp; &nbsp; &nbsp; "opcode": "0",&nbsp; &nbsp; &nbsp; "correlation": "",&nbsp; &nbsp; &nbsp; "computer": "rocky",&nbsp; &nbsp; &nbsp; "security": {&nbsp; &nbsp; &nbsp; &nbsp; "userid": "0"&nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; "provider": {&nbsp; &nbsp; &nbsp; &nbsp; "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",&nbsp; &nbsp; &nbsp; &nbsp; "name": "Linux-Sysmon"&nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; "eventid": "5",&nbsp; &nbsp; &nbsp; "version": "3",&nbsp; &nbsp; &nbsp; "keywords": "0x8000000000000000",&nbsp; &nbsp; &nbsp; "timecreated": {&nbsp; &nbsp; &nbsp; &nbsp; "systemtime": "2026-01-04T18:12:34.451516000Z"&nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; "eventrecordid": "8660",&nbsp; &nbsp; &nbsp; "execution": {&nbsp; &nbsp; &nbsp; &nbsp; "processid": "947",&nbsp; &nbsp; &nbsp; &nbsp; "threadid": "947"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; "eventdata": {&nbsp; &nbsp; &nbsp; "data": [&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "name": "RuleName",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "#text": "-"&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "name": "UtcTime",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "#text": "2026-01-04 18:12:34.454"&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "name": "ProcessGuid",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "#text": "{00000000-0000-0000-0000-000000000000}"&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "name": "ProcessId",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "#text": "2481"&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "name": "Image",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "#text": "&lt;unknown process&gt;"&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "name": "User",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "#text": "root"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; ]&nbsp; &nbsp; }&nbsp; }}</code></pre></div>

<div><pre><code>filter {&nbsp;mutate {&nbsp; remove_field =&gt; ["@timestamp", "@version", "path", "host"]&nbsp;}&nbsp;xml {&nbsp; force_array =&gt; false&nbsp; source =&gt; "message"&nbsp; target =&gt; "event"&nbsp;}}</code></pre></div>
<div><pre><code>[2026-01-06T15:53:26,650][WARN ][logstash.filters.xml&nbsp; &nbsp; &nbsp;][main][f625819b8f2d9177fe8c582c21ef75942b54954d87974d0df6db584ad56a228f] Error parsing xml with XmlSimple {:source=&gt;"message", :value=&gt;"Jan&nbsp; 5 03:12:34 rocky sysmon[947]: &lt;Event&gt;&lt;System&gt;&lt;Provider Name=\"Linux-Sysmon\" Guid=\"{ff032593-a8d3-4f13-b0d6-01fc615a0f97}\"/&gt;&lt;EventID&gt;5&lt;/EventID&gt;&lt;Version&gt;3&lt;/Version&gt;&lt;Level&gt;4&lt;/Level&gt;&lt;Task&gt;5&lt;/Task&gt;&lt;Opcode&gt;0&lt;/Opcode&gt;&lt;Keywords&gt;0x8000000000000000&lt;/Keywords&gt;&lt;TimeCreated SystemTime=\"2026-01-04T18:12:34.451516000Z\"/&gt;&lt;EventRecordID&gt;8660&lt;/EventRecordID&gt;&lt;Correlation/&gt;&lt;Execution ProcessID=\"947\" ThreadID=\"947\"/&gt;&lt;Channel&gt;Linux-Sysmon/Operational&lt;/Channel&gt;&lt;Computer&gt;rocky&lt;/Computer&gt;&lt;Security UserId=\"0\"/&gt;&lt;/System&gt;&lt;EventData&gt;&lt;Data Name=\"RuleName\"&gt;-&lt;/Data&gt;&lt;Data Name=\"UtcTime\"&gt;2026-01-04 18:12:34.454&lt;/Data&gt;&lt;Data Name=\"ProcessGuid\"&gt;{00000000-0000-0000-0000-000000000000}&lt;/Data&gt;&lt;Data Name=\"ProcessId\"&gt;2481&lt;/Data&gt;&lt;Data Name=\"Image\"&gt;&amp;lt;unknown process&amp;gt;&lt;/Data&gt;&lt;Data Name=\"User\"&gt;root&lt;/Data&gt;&lt;/EventData&gt;&lt;/Event&gt;\r", :exception=&gt;#&lt;REXML::ParseException: Malformed XML: Content at the start of the document (got 'Jan&nbsp; 5 03:12:34 rocky sysmon[947]: ')Line: 1Position: 42Last 80 unconsumed characters:&lt;Event&gt;&gt;, :backtrace=&gt;["D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/rexml-3.4.4/lib/rexml/parsers/baseparser.rb:517:in `pull_event'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/rexml-3.4.4/lib/rexml/parsers/baseparser.rb:249:in `pull'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/rexml-3.4.4/lib/rexml/parsers/treeparser.rb:21:in `parse'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/rexml-3.4.4/lib/rexml/document.rb:468:in `build'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/rexml-3.4.4/lib/rexml/document.rb:105:in `initialize'", "org/jruby/RubyClass.java:923:in `new'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:979:in `parse'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:164:in `xml_in'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:203:in `xml_in'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/logstash-filter-xml-4.3.2/lib/logstash/filters/xml.rb:196:in `filter'", "D:/ELK/v9/logstash-9.2.0/logstash-core/lib/logstash/filters/base.rb:158:in `do_filter'", "D:/ELK/v9/logstash-9.2.0/logstash-core/lib/logstash/filters/base.rb:176:in `block in multi_filter'", "org/jruby/RubyArray.java:2009:in `each'", "D:/ELK/v9/logstash-9.2.0/logstash-core/lib/logstash/filters/base.rb:173:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:133:in `multi_filter'", "D:/ELK/v9/logstash-9.2.0/logstash-core/lib/logstash/java_pipeline.rb:317:in `block in start_workers'"]}{&nbsp; &nbsp; "message" =&gt; "Jan&nbsp; 5 03:12:34 rocky sysmon[947]: &lt;Event&gt;&lt;System&gt;&lt;Provider Name=\"Linux-Sysmon\" Guid=\"{ff032593-a8d3-4f13-b0d6-01fc615a0f97}\"/&gt;&lt;EventID&gt;5&lt;/EventID&gt;&lt;Version&gt;3&lt;/Version&gt;&lt;Level&gt;4&lt;/Level&gt;&lt;Task&gt;5&lt;/Task&gt;&lt;Opcode&gt;0&lt;/Opcode&gt;&lt;Keywords&gt;0x8000000000000000&lt;/Keywords&gt;&lt;TimeCreated SystemTime=\"2026-01-04T18:12:34.451516000Z\"/&gt;&lt;EventRecordID&gt;8660&lt;/EventRecordID&gt;&lt;Correlation/&gt;&lt;Execution ProcessID=\"947\" ThreadID=\"947\"/&gt;&lt;Channel&gt;Linux-Sysmon/Operational&lt;/Channel&gt;&lt;Computer&gt;rocky&lt;/Computer&gt;&lt;Security UserId=\"0\"/&gt;&lt;/System&gt;&lt;EventData&gt;&lt;Data Name=\"RuleName\"&gt;-&lt;/Data&gt;&lt;Data Name=\"UtcTime\"&gt;2026-01-04 18:12:34.454&lt;/Data&gt;&lt;Data Name=\"ProcessGuid\"&gt;{00000000-0000-0000-0000-000000000000}&lt;/Data&gt;&lt;Data Name=\"ProcessId\"&gt;2481&lt;/Data&gt;&lt;Data Name=\"Image\"&gt;&amp;lt;unknown process&amp;gt;&lt;/Data&gt;&lt;Data Name=\"User\"&gt;root&lt;/Data&gt;&lt;/EventData&gt;&lt;/Event&gt;\r",&nbsp; &nbsp; &nbsp; &nbsp;"tags" =&gt; [&nbsp; &nbsp; &nbsp; &nbsp; [0] "_xmlparsefailure"&nbsp; &nbsp; ]}</code></pre></div>
처리를 못한다.&nbsp; 에러 메시지를 보면 xml 태그 시작 전 문자열 때문에 정상 포맷이 아니라 판단하는 듯. 해당 구간 삭제.
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivbygRSzS5Yr-R98FoqZSUxcD8k7qy0Zm8Stq9a4r29gfg6mWtsxwGN-d0XZIBcE7DEbt-lb4geRzMZFGROPKs0lQLM8gVOtS7v-C-BxA5l-WQ0y_IoucETF__NiN4v5Pi8prLC-PINfB8J9SjOXrKoTvtSVD7MmBSIHfggCsxpvIwHpvxGs3SiiHVetyE/s1823/regex.png"><img data-original-height="1205" data-original-width="1823" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivbygRSzS5Yr-R98FoqZSUxcD8k7qy0Zm8Stq9a4r29gfg6mWtsxwGN-d0XZIBcE7DEbt-lb4geRzMZFGROPKs0lQLM8gVOtS7v-C-BxA5l-WQ0y_IoucETF__NiN4v5Pi8prLC-PINfB8J9SjOXrKoTvtSVD7MmBSIHfggCsxpvIwHpvxGs3SiiHVetyE/s16000/regex.png"></a>
<div><pre><code>filter {&nbsp;mutate {&nbsp; remove_field =&gt; ["@timestamp", "@version", "path", "host"]&nbsp;}&nbsp;mutate {&nbsp; gsub =&gt; ["message", "^[^&lt;]+", ""]&nbsp;}&nbsp;xml {&nbsp; force_array =&gt; false&nbsp; source =&gt; "message"&nbsp; target =&gt; "event"&nbsp;}}</code></pre></div>
<div><pre><code>[2026-01-06T15:55:20,515][INFO ][logstash.agent&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;] Pipelines running {:count=&gt;1, :running_pipelines=&gt;[:main], :non_running_pipelines=&gt;[]}{&nbsp; &nbsp; &nbsp; "event" =&gt; {&nbsp; &nbsp; &nbsp; &nbsp; "EventData" =&gt; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Data" =&gt; [&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0] {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "content" =&gt; "-",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Name" =&gt; "RuleName"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [1] {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "content" =&gt; "2026-01-04 18:12:34.454",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Name" =&gt; "UtcTime"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [2] {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "content" =&gt; "{00000000-0000-0000-0000-000000000000}",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Name" =&gt; "ProcessGuid"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [3] {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "content" =&gt; "2481",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Name" =&gt; "ProcessId"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [4] {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "content" =&gt; "&lt;unknown process&gt;",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Name" =&gt; "Image"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [5] {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "content" =&gt; "root",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Name" =&gt; "User"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ]&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"System" =&gt; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Opcode" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "EventID" =&gt; "5",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "EventRecordID" =&gt; "8660",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Channel" =&gt; "Linux-Sysmon/Operational",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Version" =&gt; "3",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "TimeCreated" =&gt; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "SystemTime" =&gt; "2026-01-04T18:12:34.451516000Z"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Computer" =&gt; "rocky",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Level" =&gt; "4",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Task" =&gt; "5",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Execution" =&gt; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "ProcessID" =&gt; "947",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"ThreadID" =&gt; "947"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Provider" =&gt; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Guid" =&gt; "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Name" =&gt; "Linux-Sysmon"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Keywords" =&gt; "0x8000000000000000",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"Security" =&gt; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "UserId" =&gt; "0"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; "message" =&gt; "&lt;Event&gt;&lt;System&gt;&lt;Provider Name=\"Linux-Sysmon\" Guid=\"{ff032593-a8d3-4f13-b0d6-01fc615a0f97}\"/&gt;&lt;EventID&gt;5&lt;/EventID&gt;&lt;Version&gt;3&lt;/Version&gt;&lt;Level&gt;4&lt;/Level&gt;&lt;Task&gt;5&lt;/Task&gt;&lt;Opcode&gt;0&lt;/Opcode&gt;&lt;Keywords&gt;0x8000000000000000&lt;/Keywords&gt;&lt;TimeCreated SystemTime=\"2026-01-04T18:12:34.451516000Z\"/&gt;&lt;EventRecordID&gt;8660&lt;/EventRecordID&gt;&lt;Correlation/&gt;&lt;Execution ProcessID=\"947\" ThreadID=\"947\"/&gt;&lt;Channel&gt;Linux-Sysmon/Operational&lt;/Channel&gt;&lt;Computer&gt;rocky&lt;/Computer&gt;&lt;Security UserId=\"0\"/&gt;&lt;/System&gt;&lt;EventData&gt;&lt;Data Name=\"RuleName\"&gt;-&lt;/Data&gt;&lt;Data Name=\"UtcTime\"&gt;2026-01-04 18:12:34.454&lt;/Data&gt;&lt;Data Name=\"ProcessGuid\"&gt;{00000000-0000-0000-0000-000000000000}&lt;/Data&gt;&lt;Data Name=\"ProcessId\"&gt;2481&lt;/Data&gt;&lt;Data Name=\"Image\"&gt;&amp;lt;unknown process&amp;gt;&lt;/Data&gt;&lt;Data Name=\"User\"&gt;root&lt;/Data&gt;&lt;/EventData&gt;&lt;/Event&gt;\r"}</code></pre></div>
관련 글<div><ul><li><a href="https://kangmyounghun.blogspot.com/2019/01/logstash-date.html" target="">Logstash 필터 date</a></li><li><a href="http://kangmyounghun.blogspot.com/2017/06/elasticsearch-grok.html" target="_blank">Logstash 필터 grok</a></li><li><a href="http://kangmyounghun.blogspot.com/2017/07/logstash-mutate.html" target="_blank">Logstash 필터 mutate</a></li><li><a href="http://kangmyounghun.blogspot.kr/2017/10/logstash-ruby.html" target="_blank">Logstash 필터 ruby</a></li><li><a href="http://kangmyounghun.blogspot.kr/2018/02/logstash-geoip.html" target="_blank">Logstash 필터&nbsp;geoip</a></li><li><a href="http://kangmyounghun.blogspot.kr/2018/04/logstash-dissect.html" target="_blank">Logstash 필터 dissect</a></li><li><a href="http://kangmyounghun.blogspot.com/2018/09/logstash-kv.html" target="_blank">Logstash 필터&nbsp;kv</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/02/logstash-translate.html" target="_blank">Logstash 필터 translate</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/08/logstash-drop.html" target="_blank">Logstash 필터 drop</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/11/logstash-useragent.html" target="_blank">Logstash 필터 useragent</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/02/logstash-elapsed.html" target="_blank">Logstash 필터 elapsed</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/04/logstash-fingerprint.html" target="_blank">Logstash 필터 fingerprint</a></li><li><a href="https://kangmyounghun.blogspot.com/2022/12/logstash-csv.html" target="_blank">Logstash 필터 csv</a></li><li><a href="https://kangmyounghun.blogspot.com/2023/11/logstash-dns.html">Logstash 필터 dns</a></li><li><a href="https://kangmyounghun.blogspot.com/2025/01/logstash-split.html">Logstash 필터 split</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/02/logstash-codec-multiline.html" target="_blank">Logstash codec 플러그인 multiline</a></li></ul></div>

</div></div>

케세라세라

filebeat의 xml 데이터 처리. 깔끔.
processors:
  - include_fields:
      fields: "message"
  - decode_xml:
      field: message
      target_field: ""
{
  "@timestamp": "2026-01-06T06:43:46.901Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.2.1"
  },
  "message": "Jan  5 03:12:34 rocky sysmon[947]: <Event><System><Provider Name=\"Linux-Sysmon\" Guid=\"{ff032593-a8d3-4f13-b0d6-01fc615a0f97}\"/><EventID>5</EventID><Version>3</Version><Level>4</Level><Task>5</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime=\"2026-01-04T18:12:34.451516000Z\"/><EventRecordID>8660</EventRecordID><Correlation/><Execution ProcessID=\"947\" ThreadID=\"947\"/><Channel>Linux-Sysmon/Operational</Channel><Computer>rocky</Computer><Security UserId=\"0\"/></System><EventData><Data Name=\"RuleName\">-</Data><Data Name=\"UtcTime\">2026-01-04 18:12:34.454</Data><Data Name=\"ProcessGuid\">{00000000-0000-0000-0000-000000000000}</Data><Data Name=\"ProcessId\">2481</Data><Data Name=\"Image\">&lt;unknown process&gt;</Data><Data Name=\"User\">root</Data></EventData></Event>",
  "event": {
    "system": {
      "channel": "Linux-Sysmon/Operational",
      "level": "4",
      "task": "5",
      "opcode": "0",
      "correlation": "",
      "computer": "rocky",
      "security": {
        "userid": "0"
      },
      "provider": {
        "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
        "name": "Linux-Sysmon"
      },
      "eventid": "5",
      "version": "3",
      "keywords": "0x8000000000000000",
      "timecreated": {
        "systemtime": "2026-01-04T18:12:34.451516000Z"
      },
      "eventrecordid": "8660",
      "execution": {
        "processid": "947",
        "threadid": "947"
      }
    },
    "eventdata": {
      "data": [
        {
          "name": "RuleName",
          "#text": "-"
        },
        {
          "name": "UtcTime",
          "#text": "2026-01-04 18:12:34.454"
        },
        {
          "name": "ProcessGuid",
          "#text": "{00000000-0000-0000-0000-000000000000}"
        },
        {
          "name": "ProcessId",
          "#text": "2481"
        },
        {
          "name": "Image",
          "#text": "<unknown process>"
        },
        {
          "name": "User",
          "#text": "root"
        }
      ]
    }
  }
}
로그스태시로 같은 xml 데이터 처리.
filter {
 mutate {
  remove_field => ["@timestamp", "@version", "path", "host"]
 }
	
 xml {
  force_array => false
  source => "message"
  target => "event"
 }
}
[2026-01-06T15:53:26,650][WARN ][logstash.filters.xml     ][main][f625819b8f2d9177fe8c582c21ef75942b54954d87974d0df6db584ad56a228f] Error parsing xml with XmlSimple {:source=>"message", :value=>"Jan  5 03:12:34 rocky sysmon[947]: <Event><System><Provider Name=\"Linux-Sysmon\" Guid=\"{ff032593-a8d3-4f13-b0d6-01fc615a0f97}\"/><EventID>5</EventID><Version>3</Version><Level>4</Level><Task>5</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime=\"2026-01-04T18:12:34.451516000Z\"/><EventRecordID>8660</EventRecordID><Correlation/><Execution ProcessID=\"947\" ThreadID=\"947\"/><Channel>Linux-Sysmon/Operational</Channel><Computer>rocky</Computer><Security UserId=\"0\"/></System><EventData><Data Name=\"RuleName\">-</Data><Data Name=\"UtcTime\">2026-01-04 18:12:34.454</Data><Data Name=\"ProcessGuid\">{00000000-0000-0000-0000-000000000000}</Data><Data Name=\"ProcessId\">2481</Data><Data Name=\"Image\">&lt;unknown process&gt;</Data><Data Name=\"User\">root</Data></EventData></Event>\r", :exception=>#<REXML::ParseException: Malformed XML: Content at the start of the document (got 'Jan  5 03:12:34 rocky sysmon[947]: ')
Line: 1
Position: 42
Last 80 unconsumed characters:
<Event>>, :backtrace=>["D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/rexml-3.4.4/lib/rexml/parsers/baseparser.rb:517:in `pull_event'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/rexml-3.4.4/lib/rexml/parsers/baseparser.rb:249:in `pull'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/rexml-3.4.4/lib/rexml/parsers/treeparser.rb:21:in `parse'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/rexml-3.4.4/lib/rexml/document.rb:468:in `build'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/rexml-3.4.4/lib/rexml/document.rb:105:in `initialize'", "org/jruby/RubyClass.java:923:in `new'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:979:in `parse'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:164:in `xml_in'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/xml-simple-1.1.9/lib/xmlsimple.rb:203:in `xml_in'", "D:/ELK/v9/logstash-9.2.0/vendor/bundle/jruby/3.1.0/gems/logstash-filter-xml-4.3.2/lib/logstash/filters/xml.rb:196:in `filter'", "D:/ELK/v9/logstash-9.2.0/logstash-core/lib/logstash/filters/base.rb:158:in `do_filter'", "D:/ELK/v9/logstash-9.2.0/logstash-core/lib/logstash/filters/base.rb:176:in `block in multi_filter'", "org/jruby/RubyArray.java:2009:in `each'", "D:/ELK/v9/logstash-9.2.0/logstash-core/lib/logstash/filters/base.rb:173:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:133:in `multi_filter'", "D:/ELK/v9/logstash-9.2.0/logstash-core/lib/logstash/java_pipeline.rb:317:in `block in start_workers'"]}
{
    "message" => "Jan  5 03:12:34 rocky sysmon[947]: <Event><System><Provider Name=\"Linux-Sysmon\" Guid=\"{ff032593-a8d3-4f13-b0d6-01fc615a0f97}\"/><EventID>5</EventID><Version>3</Version><Level>4</Level><Task>5</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime=\"2026-01-04T18:12:34.451516000Z\"/><EventRecordID>8660</EventRecordID><Correlation/><Execution ProcessID=\"947\" ThreadID=\"947\"/><Channel>Linux-Sysmon/Operational</Channel><Computer>rocky</Computer><Security UserId=\"0\"/></System><EventData><Data Name=\"RuleName\">-</Data><Data Name=\"UtcTime\">2026-01-04 18:12:34.454</Data><Data Name=\"ProcessGuid\">{00000000-0000-0000-0000-000000000000}</Data><Data Name=\"ProcessId\">2481</Data><Data Name=\"Image\">&lt;unknown process&gt;</Data><Data Name=\"User\">root</Data></EventData></Event>\r",
       "tags" => [
        [0] "_xmlparsefailure"
    ]
}
처리를 못한다.  에러 메시지를 보면 xml 태그 시작 전 문자열 때문에 정상 포맷이 아니라 판단하는 듯. 해당 구간 삭제.
filter {
 mutate {
  remove_field => ["@timestamp", "@version", "path", "host"]
 }
	
 mutate {
  gsub => ["message", "^[^<]+", ""]
 }
 xml {
  force_array => false
  source => "message"
  target => "event"
 }
}
[2026-01-06T15:55:20,515][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
{
      "event" => {
        "EventData" => {
            "Data" => [
                [0] {
                    "content" => "-",
                       "Name" => "RuleName"
                },
                [1] {
                    "content" => "2026-01-04 18:12:34.454",
                       "Name" => "UtcTime"
                },
                [2] {
                    "content" => "{00000000-0000-0000-0000-000000000000}",
                       "Name" => "ProcessGuid"
                },
                [3] {
                    "content" => "2481",
                       "Name" => "ProcessId"
                },
                [4] {
                    "content" => "<unknown process>",
                       "Name" => "Image"
                },
                [5] {
                    "content" => "root",
                       "Name" => "User"
                }
            ]
        },
           "System" => {
                   "Opcode" => "0",
                  "EventID" => "5",
            "EventRecordID" => "8660",
                  "Channel" => "Linux-Sysmon/Operational",
                  "Version" => "3",
              "TimeCreated" => {
                "SystemTime" => "2026-01-04T18:12:34.451516000Z"
            },
                 "Computer" => "rocky",
                    "Level" => "4",
                     "Task" => "5",
                "Execution" => {
                "ProcessID" => "947",
                 "ThreadID" => "947"
            },
                 "Provider" => {
                "Guid" => "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
                "Name" => "Linux-Sysmon"
            },
                 "Keywords" => "0x8000000000000000",
                 "Security" => {
                "UserId" => "0"
            }
        }
    },
    "message" => "<Event><System><Provider Name=\"Linux-Sysmon\" Guid=\"{ff032593-a8d3-4f13-b0d6-01fc615a0f97}\"/><EventID>5</EventID><Version>3</Version><Level>4</Level><Task>5</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime=\"2026-01-04T18:12:34.451516000Z\"/><EventRecordID>8660</EventRecordID><Correlation/><Execution ProcessID=\"947\" ThreadID=\"947\"/><Channel>Linux-Sysmon/Operational</Channel><Computer>rocky</Computer><Security UserId=\"0\"/></System><EventData><Data Name=\"RuleName\">-</Data><Data Name=\"UtcTime\">2026-01-04 18:12:34.454</Data><Data Name=\"ProcessGuid\">{00000000-0000-0000-0000-000000000000}</Data><Data Name=\"ProcessId\">2481</Data><Data Name=\"Image\">&lt;unknown process&gt;</Data><Data Name=\"User\">root</Data></EventData></Event>\r"
}
관련 글
Logstash 필터 date
Logstash 필터 grok
Logstash 필터 mutate
Logstash 필터 ruby
Logstash 필터 geoip
Logstash 필터 dissect
Logstash 필터 kv
Logstash 필터 translate
Logstash 필터 drop
Logstash 필터 useragent
Logstash 필터 elapsed
Logstash 필터 fingerprint
Logstash 필터 csv
Logstash 필터 dns
Logstash 필터 split
Logstash codec 플러그인 multiline

Logstash 필터 xml

댓글