How to parse xml with combination of child nodes and name-value pairs?

[leesahic]

I am trying to parse xml such as the following. There are other element types in the xml, but I do not care about those.
<?xml version="1.0" encoding="utf-8"?>

I am trying to extract the data so that I get project{@name}, project{@ingredient}, etc. I would also like to be able to access the annotation KV pairs associated with the project. However, I am getting individual fields such as name, ingredient, pkg-path, etc., and no extraction of the annotation KV pairs.

With the following configuration, I am seeing the events as I expect, which includes, so the line breaking is working. However the field extractions are not working as desired.

props.conf:
    [kitmanifest]
    LINE_BREAKER = ([\r\n])*\<project
    NO_BINARY_CHECK = true
    TIME_FORMAT = %Y%m%dT%H%M%S%z
    TIME_PREFIX = time="
    TRUNCATE = 0
    category = Custom
    SHOULD_LINEMERGE = true
    KV_MODE = xml

    TRANSFORMS-KitManifestBuildIdExtract = KitManifestBuildIdExtract
    BREAK_ONLY_BEFORE = ([\r\n])*\<project
    DATETIME_CONFIG =
    disabled = false

transforms.conf:
    [KitManifestBuildIdExtract]
    REGEX = BuildId_(\S+)\.xml
    SOURCE_KEY = MetaData:Source
    FORMAT = kitmanifest_buildid::$1
    WRITE_META = true

I have spent a fair amount of time reading other xml questions, Splunk doc, etc., but so far no joy.

Ultimately, I need to be able to join the ingredient to another event type in order to be able to report on an ingredient's version, type, etc.

Any help would be greatly appreciated 🙂

[leesahic]

Trying to post sample xml, it is not showing in the original post:

<project name="I1" ingredient="I1" pkg-path="Tools\I1" version="4.0.3.1" artifactory="default" type="bldtool" hsd-full-name="tool.BKC – I1">
    <platforms />
    <annotations>
      <annotation name="maintainer" value="sally@mysite.com" />
      <annotation name="vendor" value="myvendor" />
      <annotation name="division" value="mydivision" />
    </annotations>
  </project>

[adonio]

thanks for the sample!
looks like the you have a closing attribute without an opening one <platforms /> is the data exactly like shown or a typo / bad copy paste?

[leesahic]

That is exactly as shown. For other projects, platforms nodes include platform nodes, but in this case there are no child platform nodes. Same is true when there are no annotations child nodes.

[leesahic]

The results are the same with KV_MODE=auto, this is the default field extraction behavior for name=value

[adonio]

can you add a sample data and desired results?

[adonio]

hello there,

driving with eyes closed here...
maybe try and change KV_MODE = xml to KV_MODE = auto

hope it solves it