Hi,
I am trying to remove elements from XML in a log file using the heavy forwarder via transforms.conf
Tried several variants, this one has come close but is only creating a single instance of what its found
e.g <name>REDACTED<name>
Current
Transforms.conf
[redact_xml]
REGEX = <(.*)>[^<]*<\/\1>
FORMAT = <$1>REDACTED<$1>
DEST_KEY = _raw
Example, the log file might have:
<?xml version="1.0" encoding="UTF-8"?> <breakfast_menu> <food><name>Belgian Waffles</name><price>$5.95</price><description> Two of our famous Belgian Waffles with plenty of real maple syrup </description><calories>650</calories> </food> <food><name>Strawberry Belgian Waffles</name><price>$7.95</price><description>Light Belgian waffles covered with strawberries and whipped cream</description><calories>900</calories> </food> <food><name>Berry-Berry Belgian Waffles</name><price>$8.95</price><description>Belgian waffles covered with assorted fresh berries and whipped cream</description><calories>900</calories> </food> <food><name>French Toast</name><price>$4.50</price><description>Thick slices made from our homemade sourdough bread</description><calories>600</calories> </food> <food><name>Homestyle Breakfast</name><price>$6.95</price><description>Two eggs, bacon or sausage, toast, and our ever-popular hash browns</description><calories>950</calories> </food> </breakfast_menu>
And I want to push into splunk the redacted version
<?xml version="1.0" encoding="UTF-8"?> <breakfast_menu> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> </breakfast_menu>
