Unable to figure out how to parse this XML doc

[kscher]

Given an event indexed from an XML document, with content like the example below, featuring a "properties" tag containing multiple "property" entries, I would like to extract a kv pair for each property. That is, for each property, "key" = the value of the property's "key" attribute and "value" = property's "value" attribute.

This is perplexing me, having tried combinations and permutations of xpath and spath. Have also tried extract using a transform that looks like this:

[agentinfo.properties]
CLEAN_KEYS = 1
FORMAT = $1::$2
REGEX = \
REPEAT_MATCH = true
MV_ADD = 1

... which I would have thought would do the trick. Anybody see what I am missing? Thanks v much in advance.

**

<Id>-336517289</Id>
<properties>
    <property value="true" key=".environment.hasApplicationCommandLine"/>
    <property value="2266747070" key="clock.frequency"/>
    <property value="UTF-8" key="runtime.codeset"/>
    <property value="1427518318882" key=".start.date"/>
    <property value="0" key=".instrumentationState"/>
    <property value="MarkSweepCompact" key="runtime.garbagecollectors"/>
    <property value="100000" key=".buffercount"/>
</properties>
<systemProfileName>profile1</systemProfileName>
<timestamp>1427518318882</timestamp>
<totalCpuTime>0.0</totalCpuTime>
<totalExecutionTime>0.0</totalExecutionTime>

**

[stephanefotso · Accepted solution]

Hello! Here you go using a search query

.............|rex field=_raw "\<property value\=\"(?<val>[^\"])\skey=\"(?<key>[^\"])"|table key value|where key!=""

Here you go using your transform.conf

[agentinfo.properties]
CLEAN_KEYS = 1
REGEX = \<property value\=\"([^\"])\skey=\"([^\"])
FORMAT = $2::$1
REPEAT_MATCH = true
MV_ADD = true

[kscher]

Thanks very much Stephane, that is a bingo.

For sake of completeness what I messed up:

1. I had the FORMAT = terms backwards
2. Regex as I originally had it didn't match anything due to \\/> at end - should have been simply \/> (single backslash)
3. Capturing groups were greedy (.*), should have been lazy (.*?)

BTW, even after fixing my regex errors, I like yours better.

[stephane_cyrill]

HI I think too that rex or regex is the best for that.try this to extract for example properties values and put them in one field:

......| rex max_match=0 field=_raw " HERE YOU PUT YOUR REGEX"

If you cannot easily write regex like me, use IFX,do as if you want to extract the values, the IFX will provide the regular expression that you can use there.

So you can do that for each of the fields you want to extract.

[kscher]

Regex as originally upload was turned into a null string. Let's see if the "code" button works:

REGEX = \<property value=\"(.*)\"\s+key=\"(.*)\"\\/>