'Pretty prints' an XML field. The function formats an XML field for improved readability. This can be an expensive operation.
It is recommended to apply xml:prettyPrint() after filtering your data at the end of the query. This prevents unnecessary formatting of data that will be discarded.
Default behaviour is as follows:
If the field does not contain
valid XML, the unmodified input value is stored in the output
field.
If no field is specified, the
@rawstring field will be formatted.
In this example, the xml:prettyPrint()
function is used to format the message field
as XML with the
strict
parameter set to true to only process valid
XML.
Uses the field
parameter to specify the message field as the
source of XML data and the
strict parameter
set to true to only process valid XML.
Formats the valid XML data for improved readability and assigns the
results to a new field named
formattedXml.
Note that if the XML in the message field is
invalid, the formattedXml
field will not be created for that event.
Event Result set.
Summary and Results
The query is used to make valid XML data more readable in the results.
Note that without
strict parameter
set to true, the
xml:prettyPrint() function attempts to format even
invalid XML, which might lead to unexpected results.
It is recommended to filter the event set as much as possible before
using the xml:prettyPrint() function to prevent
unnecessary formatting of discarded data.
logscale
|xml:prettyPrint()
Formats the XML content for improved readability.
Without a specified field, it formats the
@rawstring field.
Note that if input is not valid XML, it returns unmodified values. To
prevent this, you can set a
strict parameter.
For an example of usage, see Format Only Valid XML.
Event Result set.
Summary and Results
The query is used to make XML data more readable in the results.
Formatting XML in the @rawstring field after
filtering the data is very important as it is a resource-intensive
operation.
In this example, the xml:prettyPrint()
function is used with parameters to format the XML data in the
payload field to a max
line length of 100 and indent by 4 spaces.
Uses the field
parameter to specify the
payload field as the source of
XML data, the
step parameter
set to 4, and the
width parameter
set to 100 to format the XML data in the
payload field to a max line
length of 100 and indent by 4 spaces.
The results are assigned to a new field named
formattedXml.
Event Result set.
Summary and Results
The query is used to make XML data more readable in the results by
defining a max line length of 100 and indent by 4 spaces.
