Parse data as XML. Specify field=@rawstring to parse the @rawstring into XML. If the specified field does not exist, the event is skipped. If the specified field exists but contains non-XML data, the behaviors depends on the strict parameter.

fieldstringtrue@rawstringField that should be parsed as XML. [a]
prefixstringfalse Prefix the name of the fields extracted from XML with the value of this parameter.
strictbooleanfalsefalseSpecifies if events where the field does not contain valid XML should be filtered out of the result set. Default is non-strict, i.e. to pass the event on with an error flag describing why XML parsing failed.
  Valid ValuesfalseAll events are passed
   trueEvents that do not contain valid XML will be filtered in the result set

[a] When you provide only one parameter, the implied parameter is field


If the whole event sent to LogScale is XML like this:

<log><service>userService</service><timestamp>2017-12-18T20:39:35Z</timestamp><msg>user with id=47 logged in</msg></log>
parseXml() | parseTimestamp(field=timestamp)

If a field in the incoming event contains XML like this:

2017-12-18T20:39:35Z user id=47 logged in details="<log><service>userService</service><timestamp>2017-12-18T20:39:35Z</timestamp><msg>user with id=47 logged in</msg></log>"\n\n

In the example below, the details field is extracted using the kvParse() function and then parseXml() is used to parse the XML inside the details field.

/(?<timestamp>\S+)/ | parseTimestamp(field=timestamp) | kvParse() | parseXml(field=details)