Would like to parse out each PacketSignature as a separate event.
I have tried editing the props.conf and adding a custom data type
[PacketSignatureXML]
KV_MODE=xml
TRUNCATE=0
TIME_PREFIX=\<FirstPacketTime>
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%I
LINE_BREAKER=(<PacketSignature>)
MUST_BREAK_AFTER=(\</PacketSignature\>
<?xml version="1.0"?>
<PacketDataSummaryReport
xmlns="http://www.cablelabs.com/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.cablelabs.com/CBI-1.0.xsd">
<CaseIdentity>12345</CaseIdentity>
<IAPSystemIdentity>cable.com</IAPSystemIdentity>
<TimeStamp>2015-02-10T17:50:22.298912Z</TimeStamp>
<AccessSessionId>0</AccessSessionId>
<PacketSignature>
<sourceAddress>8.8.8.8</sourceAddress>
<destAddress>9.9.9.9</destAddress>
<sourcePort>53</sourcePort>
<destPort>23</destPort>
<protocol>18</protocol>
<NumPktsSinceLastReport>1</NumPktsSinceLastReport>
<NumBytesSinceLastReport>70</NumBytesSinceLastReport>
<FirstPacketTime>2015-02-10T17:43:32.747682Z</FirstPacketTime>
<LastPacketTime>2015-02-10T17:43:32.747682Z</LastPacketTime>
</PacketSignature>
<PacketSignature>
<sourceAddress>1.1.1.1</sourceAddress>
<destAddress>2.2.2.2</destAddress>
<sourcePort>50</sourcePort>
<destPort>24</destPort>
<protocol>20</protocol>
<NumPktsSinceLastReport>1</NumPktsSinceLastReport>
<NumBytesSinceLastReport>50</NumBytesSinceLastReport>
<FirstPacketTime>2015-02-10T17:43:35.747682Z</FirstPacketTime>
<LastPacketTime>2015-02-10T17:43:35.747682Z</LastPacketTime>
</PacketSignature>
....
</PacketDataSummaryReport>
... View more