Cribl Stream: C.Text.parseXml Fails With "invalid nodeName" When an XML Element Name Contains Non-ASCII Characters

Symptom

A pipeline that parses XML with C.Text.parseXml() in an Eval function silently skips the fields that depend on the parsed result for some events. The output event is missing the expected fields, and values derived from the parsed object fall back to their defaults (for example, _time keeps its fallback value). No error is shown on the event.

Workers log the following warning on the xml channel in cribl.log:

{"channel":"xml","level":"warn","message":"failed to parse XML.","redactedXml":"<?xml vers ... /xmlstats>","error":"invalid nodeName"}

Only events whose XML contains an element (tag) name with a non-ASCII character fail, for example <a_été_mi>. Events where non-ASCII characters appear only in element values or attribute values parse correctly.

Environment

• Cribl Stream (version: 4.20.1; not version-specific, the current upstream parser behaves the same)
• Self-managed (on-prem); the behavior is in the parser function, so it applies to Cloud as well
• Eval function (or any expression) calling C.Text.parseXml()

Resolution

C.Text.parseXml() accepts only ASCII characters in element names. A tag such as <a_été_mi> is valid XML, but the function rejects it. Until the parser is fixed, use one of the following approaches.

1. Preferred: change the producer to emit ASCII-only element names. This avoids extra processing in Stream.

2. If the source cannot change, add a Code function directly before the Eval function that calls C.Text.parseXml().

3. Set the Code function's filter so it runs only for events that need it:

   /[^\x00-\x7F]/.test(_raw)

4. Set the Code function's code to rewrite non-ASCII characters in element names only. The examples use _raw; substitute the field that holds your XML string:

   __e['_raw'] = __e['_raw'].replace(/<([?!]|\/?)([^\s>\/]+)/g, (m, lead, name) => (lead === '?' || lead === '!') ? m : '<' + lead + name.replace(/[^A-Za-z0-9_.:-]/g, '_'));

5. Leave the existing Eval function that calls C.Text.parseXml() unchanged. It now receives the sanitized string when needed and the untouched string otherwise.

6. Open Preview with a sample that contains a non-ASCII element name and confirm the parsed object is populated.

Workaround (simpler, broader)

To replace every non-ASCII character in the string, including characters in values, use this code instead:

__e['_raw'] = __e['_raw'].replace(/[^\x00-\x7F]/g, '_');

⚠️ This also alters accented text in element and attribute values.

Finding the failing events

The warning is throttled to about one line every two minutes. The logged XML snippet contains only the first and last 10 characters, and the line carries no pipeline, source, or host identifier. The element name does not appear in the log.

1. Use Preview with a captured sample to see which event fails (the parsed object stays undefined).
2. In production, filter the Worker cribl.log for channel xml and message failed to parse XML within the window of the affected host.

Cause

The XML specification allows non-ASCII characters such as é (U+00E9) in element names. The XML parser behind C.Text.parseXml() rejects them and returns undefined with the error invalid nodeName. Non-ASCII characters inside element values work as expected. For example, <tést>fóó</tést> fails, while <test>fóó</test> parses.

Because the function returns undefined rather than raising an error, downstream functions that depend on the parsed object skip silently.