Pre-index filtering - filter non-xml lines from xml data

[ajaysamantbms]

My event data contains the foll

POST:....
...
ffffff
ABCD
EFG

WERT
SDF
... and so on

As you see some lines are non-xml and some are xml..

my props.conf file has foll set of rules

[sourcetype]
BREAK_ONLY_BEFORE = ||
KV_MODE = xml
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
pulldown_type = 1
TRANSFORMS-set = setnull, setparsing

and in transforms.xml

[setnull]
REGEX= .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = ||
DEST_KEY = queue
FORMAT = indexQueue

Will this work? ...the lines outside XML tags as shown in example should not be indexed..
And should i do this in heavy forwarders or at universal lightweight forwarders

[MuS]

Hi ajaysamantbms,

the problem with this kind of question is always the same:

if this will work in your setup with your data must be tested by yourself and therefore only you will be able to answer if this will work for you or not.

the conf files look ok and the regex matches your XML data. So go ahead and test it 😉

cheers, MuS