SEDCMD replacing special character with XML entity reference

[sc0tt]

I want to replace the character < with its XML entity reference &lt between a specific tag using SEDCMD in props.conf. (I left off the trailing ; so the text would display.)

Sed script:

s/(?<=<Text>)(.*?)(<)(.*?)(?=<\/Text>)/\1\&lt\3/g

Using the above script <Text>Some < stuff</Text> becomes <Text>Some &lt stuff</Text> but I'm not sure if this is the best/correct way to accomplish this. I'd appreciate any advice.

Thanks.

[martin_mueller · Accepted solution]

This works if you have at most one <Text> tag with an arbitrary number of opening angle brackets:

| stats count | eval _raw = "<noText>no < text < ...</noText><Text>text < 1 < 2 << 3<4<</Text><meh>foo < bar</meh>" | rex mode=sed "s/<(?!(.*?<)?Text>)(?=.*?<\/Text>)/\&ltsemicolon/g"

Here's an entirely different approach that should work for an arbitrary number of <Text> tags:

| stats count | eval _raw = "<noText>no < text < ...</noText><Text>text < 1 < 2 << 3<4<</Text><meh>foo < bar</meh>" | rex mode=sed "s/<Text>/<Text><![CDATA[/g" | rex mode=sed "s/<\/Text>/]]<\/Text>/g"

[sc0tt]

Thanks for help. I'm going to test these and see if this works for my need. I want to clean up some logs and format tags as kv pairs before they are indexed.

[martin_mueller]

Oops... 😛

[jonuwz]

are you missing a closing in the 2nd example ?

[sc0tt]

Good question. It can appear any number of times. It looks like I didn't account for that.

[martin_mueller]

How often can the opening angle bracket appear within that Text tag?