Hi All,
I recently recognized KV_MODE = xml is only working when the event is plain XML.
Unfortunately, the XML data in my events is prefixed with a timestamp and some other information, e.g.:
[2013-03-08 08:16:53,184] INFO technical.http.XMLLogger createLogEntry - IN <-- foo bar DataRequest /10.104.180.7:59117 <?xml version="1.0" encoding="ISO-8859-1"?><stuff><goes><here /></goes></stuff></xml>
When I manually enforce XML field extraction with the search command xmlkv, it seems to work fine as well.
Any idea how I can envforce XML field extraction in props.conf even if my events aren't plain xml?
Thanks,
Simon
You want to use the SEDCMD in your props.conf to remove every thing up where the actual XML starts. In doing so, you do lose the data before the XML.