One simple and low-tech way is to use eval's 'replace' function.
its not the prettiest but it might not make your head hurt as much as using rex in 'sed' mode. 😃
after your rex:
| rex "\<properties>(?<Properties>.*)\</properties>" |
put this:
| eval Properties=replace(Properties, "</key><value>", " = ") | eval Properties=replace(Properties, "</value></property><property><key>", " | ") | eval Properties=replace(Properties, "<property><key>", "") | eval Properties=replace(Properties, "</value></property>", "")
and while we're considering nutty solutions, here's another one. Again tack this onto the end of your rex where you're extracting the Properties string.
| eval Properties=replace(Properties, "<property>", "") | makemv Properties delim="</property>" | mvexpand Properties | rename Properties as _raw | xmlkv
that last one actually makes multivalued field and then splits them into their own rows... mileage/applicability may vary.
... View more
