Skip to content
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

## `parseXml()`

Parse data as XML. Specify `field=@rawstring` to parse the @rawstring into XML. If the specified field does not exist, the event is skipped. If the specified field exists but contains non-XML data, the behaviors depends on the strict parameter.

Parameter | Type | Required | Default Value | Description
--- | --- | --- | --- | ---
`field`[a] | string | required | `@rawstring` | Field that should be parsed as XML.
`prefix` | string | optional[b] |  | Prefix the name of the fields extracted from XML with the value of this parameter.
`strict` | boolean | optional[b] | `false` | Specifies if events where the field does not contain valid XML should be filtered out of the result set.
|  |  | Values
|  |  | `false` | All events are passed, including an error flag describing why the event parsing failed
|  |  | `true` | Events that do not contain valid XML will be filtered in the result set
[a] The parameter name `field` can be omitted. [b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

> Omitted Argument Names

> The argument name for `field` can be omitted; the following forms of this function are equivalent:

> logscale Syntax

>     parseXml("value")

> and:

> logscale Syntax

>     parseXml(field="value")

> These examples show basic structure only.

### `parseXml()` Syntax Examples

If the whole event sent to LogScale is XML like this:

xml

    <log><service>userService</service><timestamp>2017-12-18T20:39:35Z</timestamp><msg>user with id=47 logged in</msg></log>

logscale

    parseXml()
    | parseTimestamp(field=timestamp)

If a field in the incoming event contains XML like this:

xml

    2017-12-18T20:39:35Z user id=47 logged in details="<log><service>userService</service><timestamp>2017-12-18T20:39:35Z</timestamp><msg>user with id=47 logged in</msg></log>"\n\n

In the example below, the details field is extracted using the `kvParse()` function and then `parseXml()` is used to parse the XML inside the details field.

logscale

    /(?<timestamp>\S+)/
    | parseTimestamp(field=timestamp)
    | kvParse()
    | parseXml(field=details)

### `parseXml()` Examples

Click + next to an example below to get the full details.

#### Parse XML Content From Task Triggers

Extract and analyze XML data from scheduled tasks using the `parseXml()` function

##### Query

logscale

    #event_simpleName=ScheduledTaskRegistered
    | parseXml(TaskXml)
    | Trigger:=rename(Task.Triggers.LogonTrigger.Enabled)
    | Trigger=*
    | table([aid, Trigger, TaskXml], limit=1000)

##### Introduction

In this example, the `parseXml()` function is used to extract trigger information from scheduled task XML data.

Example incoming data might look like this:

@timestamp | aid | event_simpleName | TaskXml
--- | --- | --- | ---
2025-10-15T10:00:00Z | aid123 | ScheduledTaskRegistered | <Task><Triggers><LogonTrigger><Enabled>true</Enabled></LogonTrigger></Triggers></Task>
2025-10-15T10:01:00Z | aid124 | ScheduledTaskRegistered | <Task><Triggers><LogonTrigger><Enabled>false</Enabled></LogonTrigger></Triggers></Task>
2025-10-15T10:02:00Z | aid125 | ScheduledTaskRegistered | <Task><Triggers><LogonTrigger><Enabled>true</Enabled></LogonTrigger></Triggers></Task>
2025-10-15T10:03:00Z | aid126 | ScheduledTaskRegistered | <Task><Triggers><LogonTrigger><Enabled>false</Enabled></LogonTrigger></Triggers></Task>

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       #event_simpleName=ScheduledTaskRegistered

   Filters events where event_simpleName equals `ScheduledTaskRegistered`.

3. logscale

       | parseXml(TaskXml)

   Parses the XML content from the TaskXml field. The function creates a structured object with the parsed XML data, making nested elements accessible using dot notation.

4. logscale

       | Trigger:=rename(Task.Triggers.LogonTrigger.Enabled)

   Creates a new field named Trigger containing the value from the parsed XML path Task.Triggers.LogonTrigger.Enabled.

5. logscale

       | Trigger=*

   Filters to keep only events where Trigger has a value. This line can be removed if empty trigger values should be included in the results.

6. logscale

       | table([aid, Trigger, TaskXml], limit=1000)

   Creates a table showing the aid, Trigger, and original TaskXml fields, limited to 1000 rows.

7. Event Result set.

##### Summary and Results

The query is used to extract and analyze trigger settings from scheduled task XML data.

This query is useful, for example, to monitor and audit scheduled task configurations and identify tasks with specific trigger settings.

Sample output from the incoming example data:

aid | Trigger | TaskXml
--- | --- | ---
aid123 | true | <Task><Triggers><LogonTrigger><Enabled>true</Enabled></LogonTrigger></Triggers></Task>
aid124 | false | <Task><Triggers><LogonTrigger><Enabled>false</Enabled></LogonTrigger></Triggers></Task>
aid125 | true | <Task><Triggers><LogonTrigger><Enabled>true</Enabled></LogonTrigger></Triggers></Task>
aid126 | false | <Task><Triggers><LogonTrigger><Enabled>false</Enabled></LogonTrigger></Triggers></Task>

#### Parse XML With Multiple Inner Elements

Handle repeated XML elements using the `parseXml()` function

##### Query

logscale

    parseXml()

##### Introduction

In this example, the `parseXml()` function is used to parse XML data containing multiple instances of the same element name, demonstrating how both single and array-indexed fields are created.

Example incoming data might look like this:

@rawstring
<outer><inner>1</inner><inner>2</inner><inner>3</inner></outer>

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       parseXml()

   Parses the XML content from the @rawstring field and creates multiple fields:

   outer.inner - contains the value of the first inner element (`1`).

   outer.inner[0], outer.inner[1], and outer.inner[2] - contain all values as an array (`1`, `2`, `3`).

   When no field parameter is specified, `parseXml()` uses the @rawstring field by default.

3. Event Result set.

##### Summary and Results

The query is used to parse XML data containing multiple instances of the same element and create an indexed array of values.

This query is useful, for example, to process XML logs containing repeated elements such as multiple error messages, list items, or configuration entries.

Sample output from the incoming example data:

outer.inner | outer.inner[0] | outer.inner[1] | outer.inner[2]
--- | --- | --- | ---
1 | 1 | 2 | 3

Note that outer.inner contains the same value as outer.inner[0], providing both a direct reference to the first value and array access to all values.

#### Enter search term