Quantcast
Channel: Questions in topic: "props.conf"
Viewing all articles
Browse latest Browse all 1485

Why is my XML Log not parsing correctly?

$
0
0
I am attempting to import a ws_ftp log, but I am having issues parsing the log data. I can either get it to have no fields extracted or I end up with hundreds of entries for each event as it does not appear to break properly. Sample log data: 20170214-10:59:58COM_API0000000101testftpLogin278AA2E9-04A9-4484-9EAC-DF1EACBDF37220170214-11:01:39COM_API0000000101testftpCreateUser278AA2E9-04A9-4484-9EAC-DF1EACBDF37220170214-11:01:39COM_API0000000101testftpSetSysAdmin278AA2E9-04A9-4484-9EAC-DF1EACBDF372 From some post I have created a props.conf file of: [WS_FTP] TIME_PREFIX = \ TIME_FORMAT = %Y\%m\%d-%H:%M:%S SHOULD_LINEMERGE = false LINE_BREAKER = \>\s*(?=\) REPORT-xmlext = xml-extr and a transforms.conf: [xml-extr] REGEX = <([^>]+)>([^<]*)<\/\1> FORMAT = $1::$2 MV_ADD = true REPEAT_MATCH = true I need to have each entry listed with the associated data as opposed to what i am getting now where there is an event for: , 278AA2E9-04A9-4484-9EAC-DF1EACBDF372, etc. It seems to be right there, but still something is not working. I have tried without the transforms and only that props.conf, but that too yields similar results, so any help in getting each "entry" properly extracted would be much appreciated.

Viewing all articles
Browse latest Browse all 1485

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>