need help to remove xml tag with attribute

[dmuley]

I have the event that looks like below 

2022-06-15 19:59:57.489 threadId=L4GFP2275S1K class="ActiveSession" mname="NA" callId="NA" eventType="InMsg" data="<InfoNox_Interface xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><TestRQ><Merchant_ID>testmid</Merchant_ID></TestRQ>"

and I would like to remove below xml element with attribute from data fields , How can I do that ?

<InfoNox_Interface xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

Results I want is 

2022-06-15 19:59:57.489 threadId=L4GFP2275S1K class="ActiveSession" mname="NA" callId="NA" eventType="InMsg" data="<TestRQ><Merchant_ID>testmid</Merchant_ID></TestRQ>"

[dmuley]

this is not first element (but specific element) always and since we dont have access to rops.conf need solution to get pure data while querying

@richgalloway  

[richgalloway]

Thanks for clarifying the question.  Try adding this rex command to your query.

| rex mode=sed "s/\<InfoNox_Interface .+?\>//"

[richgalloway]

Assuming it's always the first tag in the data field then this may help.  Put it in the appropriate props.conf stanza.

SEDCMD-remtag = s/data="<[^\>]+>/data="/