Hi, I am trying to extract the field tags and values between the interceptor and \Interceptor tags but am not able to, a sample of the xml is below,
<Interceptor>
<AttackCoords>-80.24185962413824,25.24598123976225</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>5</Infiltrators>
<Enforcer>Baleineau</Enforcer>
<ActionDate>2013-07-05</ActionDate>
<ActionTime>06:15:00</ActionTime>
<RecordNotes>
Infiltrators: Izar Carrillo, Bartolo Gracia, Xevera Lerma, Flaca Santiago, Xaviera Villalpando
</RecordNotes>
<NumEscaped>0</NumEscaped>
<LaunchCoords/>
<AttackVessel>Raft</AttackVessel>
</Interceptor>
my props.conf and transforms.conf looks like the following
[dreamcrusher]
BREAK_ONLY_BEFORE =
DATETIME_CONFIG =
NO_BINARY_CHECK = true
category = Custom
pulldown_type = true
PREAMBLE_REGEX = (<\?xml.*||<.*dataroot>)
SEDCMD-dr = s/<\/dataroot>//g
TIME_FORMAT = %Y-%m-%d%n%H:%M:%S
TIME_PREFIX =
MAX_DAYS_AGO = 5000
REPORT-fieldvalues = field
disabled = false
LINE_BREAKER =
TRUNCATE =
[field]
CLEAN_KEYS = 0
REGEX = <(\w+)>([^<]+)
FORMAT=$1::$2
MV_ADD = true
upon ingesting the event data, I can not see any search time fields being extracted and i am not sure where I am going wrong, gone through many similar posts and have tried a few things but no luck unfortunately, am i doing something incorrect with my props and transform conf files? please do enlighten me!
Any help would be greatly appreciated!
