Did you ever figure this out? ... View more

I had to change the first regular expression to the following. \<Data\>(?<zzz_sql_audit_data>[^*]*)\<\/Data\> ... View more

Also, Which .conf files are you editing? Is it in a specific app on the SQL server or an app on the indexer? ... View more

Does that regular expression work for you? \<Data\>(?<zzz_sql_audit_data>.+?)\<\/Data\>  I have not been able to get it to work.  ... View more