extract only xml part from an event

[eranhauser]

Hi,
my event has unstructured data i.e. few strings than xml part than few more strings and another xml follow by few more strings.
How do I extract only the xml parts from the event when there is no pattern  to the string i.e. number of lines before and after the xml nor the string content has a pattern.

[eranhauser]

it loos like
this is the first line
this is the second line

<!DOCTYPE....>

......... the rest of the xml is here

this is the third line

<!DOCTYPE...>

.......rest of the xml is here

this is the fourth line

this is the fifth line

[isoutamo]

Is there any word or some token how you know where first xml part will ends or is it just end of line and then 3rd line is some other text?

[eranhauser]

I am trying to get values from xml part of an event. The event starts with few lines than it has xml part, after that few more lines and another xml part. I want to extract at first only the parts of the event that are in xml format.

[isoutamo]

Hi

until you give some sample data to us, it’s hard to tell exactly how to do it. Here is some ideas how to proceed with this case

...
| rex "....(?<yourXML>....until it ends)...."
| fields _time yourXML
| xmlkv maxinputs=99999 yourXML
....

r. Ismo

[richgalloway]

We need more information. Are you trying to extract at search time or index time?  Are you trying keep the XML or discard it?  Please share a sanitized sample event or two.