xml filter xpath silent failure

[SleeperSmith]

The offending line is at line 93:
begin
doc = Nokogiri::XML(value)
rescue => e
event.tag("_xmlparsefailure")
@logger.warn("Trouble parsing xml", :source => @source, :value => value,
:exception => e, :backtrace => e.backtrace)
return
end

When Nokogiri fails, it does not throw, but instead it puts the error into an "errors" property. So you need to check for doc.errors for parse failures.

This especially problematic in situation where Nokogiri fails to parse but XmlSimple succeeds. Logstash would pump out the log with the structure expanded but none of the xpath would work obviously. (The exact problem i encountered.) The offending character in my case was etc with error message "#<Nokogiri::XML::SyntaxError: Content is not allowed in prolog.>".

P.S. I don't do ruby, so I can't really do a bug fix and pull request.

[jordansissel]

I've moved this here: logstash-plugins/logstash-filter-xml#10