Hi, I am trying to remove elements from XML in a log file using the heavy forwarder via transforms.conf Tried several variants, this one has come close but is only creating a single instance of what its found e.g <name>REDACTED<name> Current Transforms.conf [redact_xml] REGEX = <(.*)>[^<]*<\/\1> FORMAT = <$1>REDACTED<$1> DEST_KEY = _raw Example, the log file might have: <?xml version="1.0" encoding="UTF-8"?> <breakfast_menu> <food><name>Belgian Waffles</name><price>$5.95</price><description> Two of our famous Belgian Waffles with plenty of real maple syrup </description><calories>650</calories> </food> <food><name>Strawberry Belgian Waffles</name><price>$7.95</price><description>Light Belgian waffles covered with strawberries and whipped cream</description><calories>900</calories> </food> <food><name>Berry-Berry Belgian Waffles</name><price>$8.95</price><description>Belgian waffles covered with assorted fresh berries and whipped cream</description><calories>900</calories> </food> <food><name>French Toast</name><price>$4.50</price><description>Thick slices made from our homemade sourdough bread</description><calories>600</calories> </food> <food><name>Homestyle Breakfast</name><price>$6.95</price><description>Two eggs, bacon or sausage, toast, and our ever-popular hash browns</description><calories>950</calories> </food> </breakfast_menu> And I want to push into splunk the redacted version <?xml version="1.0" encoding="UTF-8"?> <breakfast_menu> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> </breakfast_menu>
... View more
