'Pretty prints' an XML field. The function formats an XML field for improved readability. This can be an expensive operation.

It is recommended to apply xml:prettyPrint() after filtering your data at the end of the query. This prevents unnecessary formatting of data that will be discarded.

Default behaviour is as follows:

  • If the field does not contain valid XML, the unmodified input value is stored in the output field.

  • If no field is specified, the @rawstring field will be formatted.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a]   The name of the field to store the output in.
field[b]stringrequired @rawstring The name of the field to format.
stepintegeroptional[a] 2 The indentation in number of characters.
strictbooleanoptional[a] false If set to true only valid XML input produce a value in the output field. By default invalid XML is copied to the output field unmodified.
widthintegeroptional[a] 80 The width (in number of characters) to fit the output input.

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Click + next to an example below to get the full details.

Format Only Valid XML

Format only XML data that is considered valid using the xml:prettyPrint() function

Query
logscale
formattedXml := xml:prettyPrint(field=message, strict=true)
Introduction

In this example, the xml:prettyPrint() function is used to format the message field as XML with the strict parameter set to true to only process valid XML.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    formattedXml := xml:prettyPrint(field=message, strict=true)

    Uses the field parameter to specify the message field as the source of XML data and the strict parameter set to true to only process valid XML.

    Formats the valid XML data for improved readability and assigns the results to a new field named formattedXml.

    Note that if the XML in the message field is invalid, the formattedXml field will not be created for that event.

  3. Event Result set.

Summary and Results

The query is used to make valid XML data more readable in the results.

Note that without strict parameter set to true, the xml:prettyPrint() function attempts to format even invalid XML, which might lead to unexpected results.

Format XML

Format XML in @rawstring field using the xml:prettyPrint() function

Query
logscale
#type=SOAP
        | account=123
        | xml:prettyPrint()
Introduction

In this example, the xml:prettyPrint() function is used to format the @rawstring field.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    #type=SOAP

    Filters for events with the XML type.

  3. logscale
    | account=123

    Filters for events related to account 123.

    It is recommended to filter the event set as much as possible before using the xml:prettyPrint() function to prevent unnecessary formatting of discarded data.

  4. logscale
    | xml:prettyPrint()

    Formats the XML content for improved readability. Without a specified field, it formats the @rawstring field.

    Note that if input is not valid XML, it returns unmodified values. To prevent this, you can set a strict parameter. For an example of usage, see Format Only Valid XML.

  5. Event Result set.

Summary and Results

The query is used to make XML data more readable in the results. Formatting XML in the @rawstring field after filtering the data is very important as it is a resource-intensive operation.

Format XML to a Max Line Length

Format XML in @rawstring field using the xml:prettyPrint() function with custom formatting parameters set

Query
logscale
formattedXml := xml:prettyPrint(field=payload, step=4, width=100)
Introduction

In this example, the xml:prettyPrint() function is used with parameters to format the XML data in the payload field to a max line length of 100 and indent by 4 spaces.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    formattedXml := xml:prettyPrint(field=payload, step=4, width=100)

    Uses the field parameter to specify the payload field as the source of XML data, the step parameter set to 4, and the width parameter set to 100 to format the XML data in the payload field to a max line length of 100 and indent by 4 spaces.

    The results are assigned to a new field named formattedXml.

  3. Event Result set.

Summary and Results

The query is used to make XML data more readable in the results by defining a max line length of 100 and indent by 4 spaces.