KV_MODE = xml with prefixed XML data

[Simon]

Hi All,

I recently recognized KV_MODE = xml is only working when the event is plain XML.
Unfortunately, the XML data in my events is prefixed with a timestamp and some other information, e.g.:

[2013-03-08 08:16:53,184] INFO  technical.http.XMLLogger createLogEntry - IN  <-- foo  bar  DataRequest      /10.104.180.7:59117  <?xml version="1.0" encoding="ISO-8859-1"?><stuff><goes><here /></goes></stuff></xml>

When I manually enforce XML field extraction with the search command xmlkv, it seems to work fine as well.

Any idea how I can envforce XML field extraction in props.conf even if my events aren't plain xml?

Thanks,

Simon

[rdownie]

You want to use the SEDCMD in your props.conf to remove every thing up where the actual XML starts. In doing so, you do lose the data before the XML.