How to pattern multiline XML using RegEx in NXLog How to pattern multiline XML using RegEx in NXLog elasticsearch elasticsearch

How to pattern multiline XML using RegEx in NXLog


You should be able to use nxlog's xm_multiline module and specify the regexp in the HeaderLine directive.If you add a capturing rule to the regexp to match the XML part (stuff after the [..]) then you should be able to parse the XML with xm_xml's parse_xml().

There is a similar example here.


Try doing this using a multiline ReGex :

$ perl -0777 -ne 'print $& if !<RESPONSE>.*</RESPONSE>!s' file

Setting the input/output separator as undef (-0777) will slurp the whole file in memory

Output:

<RESPONSE>  <RESPONSE_TEXT>Operation SUCCESSFUL</RESPONSE_TEXT>  <RESULT>OK</RESULT>  <RESULT_CODE>-1</RESULT_CODE>  <TERMINATION_STATUS>SUCCESS</TERMINATION_STATUS>  <COUNTER>221</COUNTER>  <SECONDARY_DATA>12</SECONDARY_DATA>  <MACLABEL_IN_SESSION>P_061</MACLABEL_IN_SESSION>  <SESSION_DURATION>00:00:16</SESSION_DURATION>  <INVOICE_SESSION>XX</INVOICE_SESSION>  <SERIAL_NUMBER>XX</SERIAL_NUMBER></RESPONSE>

In a script :

BEGIN { $/ = undef; $\ = undef; } # input/output separator as undefwhile (defined($_ = <ARGV>)) {    print $& if m[<RESPONSE>.*</RESPONSE>]s;}

from perldoc perlre for modifier 's'

 s   Treat string as single line. That is, change "." to match any     character whatsoever, even a newline, which normally it would not     match.