I have a xml message with multiple lines. How can we extract entire data into a field?
Use replace command to remove new line characters from raw event data.
Use rex to identify start and end of XML data.
For example for the following data
2016/10/20 01:01:30.123 Request Data XML : <root>
Following SPL should do the extraction. (PS: You might have to try to remove \r also based on whether you have just new line (\n) or line feed (\r) character as well in your raw data)
| <Your Base Search>
| eval rawsingleline= replace(_raw,"\n","")
| rex field=rawsingleline "Request Data XML : (?<xmldata>.*)"
View solution in original post