Quantcast
Channel: Questions in topic: "props.conf"
Viewing all articles
Browse latest Browse all 1485

How can I parse XML with multivalue fields?

$
0
0
Here's a small snippet of an xml firewall event i'm trying to parse:1Temperature @ Ocelot0.060.0False36.01Temperature @ Switch0.060.0False37.5 Ideally i'd like to set up a process to extract the two entries above as separate fields (Temp_Ocelot=36.0, Temp_Switch=37.5). I know I can do this with xpath at search time pretty easily as: ..... | xpath outfield=Temp_Ocelot "//response/result/thermal/Slot1/entry[description='Temperature @ Ocelot']/DegreesC" But i'd like to define this in the configuration files to parse out the fields automatically. For instance, here's how I set up a props.conf to extract the XML generically so that it extracts all possible fields: [pa_env] DATETIME_CONFIG = CURRENT KV_MODE = xml LINE_BREAKER = () MUST_BREAK_AFTER = \ NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TRUNCATE = 0 pulldown_type = 1 But this leads to a lot of multivalue records, which I then have to deal with through mvzip, mvexpand, etc. Is there a way to set up props.conf (or additionally transforms.conf) to extract the individual tags of interest as individual fields? At first I thought I could do something with the FIELDALIAS in props.conf to extract a specific entry description following how it's done in xpath, but that didn't work. Here's what I tried: FIELDALIAS-rootfields = response.result.thermal.Slot1.entry[description='Temperature @ Ocelot'].DegreesC as Temp_Ocelot Is there a way to specify a specific tag based on its properties in a FIELDALIAS? Thanks

Viewing all articles
Browse latest Browse all 1485

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>