Skip to content

Latest commit

 

History

History
205 lines (171 loc) · 5.37 KB

xml_parser.md

File metadata and controls

205 lines (171 loc) · 5.37 KB

xml_parser operator

The xml_parser operator parses the string-type field selected by parse_from as XML.

Configuration Fields

Field Default Description
id xml_parser A unique identifier for the operator
output Next in pipeline The connected operator(s) that will receive all outbound entries
parse_from $ A field that indicates the field to be parsed as XML
parse_to $ A field that indicates where to parse structured data to
preserve_to Preserves the unparsed value at the specified field
on_error send The behavior of the operator if it encounters an error. See on_error
if An expression that, when set, will be evaluated to determine whether this operator should be used for the given entry. This allows you to do easy conditional parsing without branching logic with routers.
strict true A boolean value that sets the xml.Decoder.Strict field of the parser. When not configured, value is defaulted to true
timestamp nil An optional timestamp block which will parse a timestamp field before passing the entry to the output operator
severity nil An optional severity block which will parse a severity field before passing the entry to the output operator

Example Configurations

Parse the field message as XML

Configuration:

- type: xml_parser
  parse_from: message
Input record Output record 
{
  "timestamp": "",
  "record": {
    "message": "<person age='30'>Jon Smith</person>"
  }
}
 
{
  "timestamp": "",
  "record": {
    "tag": "person",
    "attributes": {
      "age": "30"
    },
    "content": "Jon Smith"
  }
}

Parse the field message as XML WITHOUT strict

Configuration:

- type: xml_parser
  parse_from: message
  strict : false
Input record Output record 
{
  "timestamp": "",
  "record": {
    "message": "<person company='at&t'>Jon Smith</person>"
  }
}
 
{
  "timestamp": "",
  "record": {
    "tag": "person",
    "attributes": {
      "company": "at&t"
    },
    "content": "Jon Smith"
  }
}

Parse multiple xml elements

Configuration:

- type: xml_parser
  parse_from: message
Input record Output record 
{
  "timestamp": "",
  "record": {
    "message": "<person age='30'>Jon Smith</person><person age='28'>Sally Smith</person>"
  }
}
 
{
  "timestamp": "",
  "record": [
    {
    "tag": "person",
    "attributes": {
      "age": "30"
    },
    "content": "Jon Smith"
    },
    {
    "tag": "person",
    "attributes": {
      "age": "28"
    },
    "content": "Sally Smith"
    }
  ]
}

Parse embedded xml elements

Configuration:

- type: xml_parser
  parse_from: message
Input record Output record 
{
  "timestamp": "",
  "record": {
    "message": "<worker><person age='30'>Jon Smith</person></worker>"
  }
}
 
{
  "timestamp": "",
  "record": {
    "tag": "worker",
    "children": [
      {
        "tag": "person",
        "attributes": {
          "age": "30"
        },
        "content": "Jon Smith"
      }
    ]
  }
}