Pre-index filtering - filter non-xml lines from xml data

ajaysamantbms — Mon, 28 Sep 2020 16:12:48 GMT

My event data contains the foll

POST:....
...
ffffff
ABCD
EFG

WERT
SDF
... and so on

As you see some lines are non-xml and some are xml..

my props.conf file has foll set of rules

[sourcetype]
BREAK_ONLY_BEFORE = ||
KV_MODE = xml
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
pulldown_type = 1
TRANSFORMS-set = setnull, setparsing

and in transforms.xml

[setnull]
REGEX= .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = ||
DEST_KEY = queue
FORMAT = indexQueue

Will this work? ...the lines outside XML tags as shown in example should not be indexed..
And should i do this in heavy forwarders or at universal lightweight forwarders

Re: Pre-index filtering - filter non-xml lines from xml data

MuS — Mon, 24 Mar 2014 09:27:36 GMT

Hi ajaysamantbms,

the problem with this kind of question is always the same:

if this will work in your setup with your data must be tested by yourself and therefore only you will be able to answer if this will work for you or not.

the conf files look ok and the regex matches your XML data. So go ahead and test it 😉

cheers, MuS

topic Re: Pre-index filtering - filter non-xml lines from xml data in Getting Data In

Pre-index filtering - filter non-xml lines from xml data

Re: Pre-index filtering - filter non-xml lines from xml data