Format Only Valid XML

Format only XML data that is considered valid using the xml:prettyPrint() function

Query

logscale
formattedXml := xml:prettyPrint(field=message, strict=true)

Introduction

The xml:prettyPrint() function can be used to format an XML field for improved readability. When used without parameters, xml:prettyPrint() assumes, that the XML is in the @rawstring field.

In this example, the xml:prettyPrint() function is used to format the message field as XML with the strict parameter set to true to only process valid XML.

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0>Augment Data] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    formattedXml := xml:prettyPrint(field=message, strict=true)

    Uses the field parameter to specify the message field as the source of XML data and the strict parameter set to true to only process valid XML.

    Formats the valid XML data for improved readability and assigns the results to a new field named formattedXml.

    Note that if the XML in the message field is invalid, the formattedXml field will not be created for that event.

  3. Event Result set.

Summary and Results

The query is used to make valid XML data more readable in the results.

Note that without strict parameter set to true, the xml:prettyPrint() function attempts to format even invalid XML, which might lead to unexpected results.