@marcoemme41, ideally if you are interested in <book> being the root node of individual events and not <purchases> you should try to index only <book> node and discard <publisher> node by pushing to null queue:
props.conf
BREAK_ONLY_BEFORE=\<book\>
MUST_BREAK_AFTER=\<\/book\>
KV_MODE=xml
TRANSFORMS-nullQueueDiscardPurchases=nullQueueDiscardPurchases
transforms.conf
[nullQueueDiscardPurchases]
REGEX = purchases
DEST_KEY = queue
FORMAT = nullQueue
However, as per your question following is searchtime . Consider this only as workaround, since, ideal way would to ingest the data in proper way as expected.
| makeresults
| eval _raw="
<purchases>
<book>
<author>Martin</author>
<title>A Game of Thrones</title>
<title>A Clash of Kings</title>
</book>
<book>
<author>Clarke</author>
<title>Jonathan Strange</title>
</book>
</purchases>"
| spath input=_raw path=purchases
| eval purchases=replace(purchases,"</book>","</book>|")
| makemv purchases delim="|"
| mvexpand purchases
| rename purchases as _raw
| spath
... View more
