Need help with indexing xml file.

the_wolverine — Wed, 14 Mar 2012 04:34:20 GMT

I have XML in the following format that just refuses to break where I want it to --

<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
    <Property Name="PSComputerName" Type="System.String">name.domain.com</Property>
    <Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
    <Property Name="ObjectModified" Type="System.String">domain.com/My DL's/National Sales</Property>
    <Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
    <Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
      <Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
    </Property>
    <Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
    <Property Name="Caller" Type="System.String">domain.com/MyAdmins/My IFS/Teddybear</Property>
    <Property Name="Succeeded" Type="System.Boolean">True</Property>
    <Property Name="Error" Type="System.String">None</Property>
    <Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:03 PM</Property>
    <Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
    <Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv258AAAJ</Property>
    <Property Name="IsValid" Type="System.Boolean">True</Property>
  </Object>
  <Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
    <Property Name="PSComputerName" Type="System.String">name.domain.com\x
00</Property>
    <Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
    <Property Name="ObjectModified" Type="System.String">server.com/My DL's/Self Service/Engineering Communications</Property>
    <Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
    <Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
      <Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
    </Property>
    <Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
    <Property Name="Caller" Type="System.String">name.com/MyAdmins/My IFS/Teddybear</Property>
    <Property Name="Succeeded" Type="System.Boolean">True</Property>
    <Property Name="Error" Type="System.String">None</Property>
    <Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:02 PM</Property>
    <Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
    <Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv257AAAJ</Property>
    <Property Name="IsValid" Type="System.Boolean">True</Property>
  </Object>

My props.conf:

[my_xml]
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = False
MAX_TIMESTAMP_LOOKAHEAD = 500
TIME_PREFIX = (?m)\s* Type="System.DateTime">
LINE_BREAKER = </Object>(\s*)<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">

Re: Need help with indexing xml file.

Ayn — Wed, 14 Mar 2012 06:22:21 GMT

I don't see a tag called <Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent"> in your sample data? Either it's just omitted in the sample or it's the cause of why the LINE_BREAKER won't apply.

Re: Need help with indexing xml file.

the_wolverine — Wed, 14 Mar 2012 16:28:31 GMT

Sorry I just updated the sample with the correct one. I'm using various samples to get this to work.

Re: Need help with indexing xml file.

Ayn — Thu, 15 Mar 2012 07:30:48 GMT

I'm not entirely sure whether the \s you're matching on will match newlines as well by default. Might want to try putting a (?ms) at the start of the regex.

Re: Need help with indexing xml file.

kristian_kolb — Tue, 27 Mar 2012 06:08:49 GMT

Perhaps you've misplaced it on the line above. I don't think TIME_PREFIX require a multiline specification.
/k

topic Re: Need help with indexing xml file. in Getting Data In

Need help with indexing xml file.

Re: Need help with indexing xml file.

Re: Need help with indexing xml file.

Re: Need help with indexing xml file.

Re: Need help with indexing xml file.