ConvertTextToElementsXML

Learn about the ConvertTextToElementsXML OTTL converter function.

  less than a minute  

The ConvertTextToElementsXML converter wraps text content in an XML element with a dedicated tag.

Syntax: ConvertTextToElementsXML(xml_string, tag_name)

  • xml_string: the bracket notation location of the XML string field
  • tag_name (optional): the new tag name for wrapping the text

Consider the following log:

<system><event type="startup" severity="info"> System initializing...<message>Check configuration settings.</message></event>System initialized.</system>

As it is ingested it is escaped into JSON and saved as a byte array. See Understand Escaping Characters and Working with the body. Suppose the log is decoded and saved in an attribute named decoded.

Input

{
	"_type": "log",
	"attributes": {
		"decoded": "<system><event type=\"startup\" severity=\"info\"> System initializing...<message>Check configuration settings.</message></event>System initialized.</system>"
	},
	"body": "<system><event type=\"startup\" severity=\"info\"> System initializing...<message>Check configuration settings.</message></event>System initialized.</system>",
	"resource": {...},
	"timestamp": 1733458494510
}

Statement

set(attributes["elements"], ConvertTextToElementsXML(attributes["decoded"]))

Output

{
	"_type": "log",
	"attributes": {
		"decoded": "<system><event type=\"startup\" severity=\"info\"> System initializing...<message>Check configuration settings.</message></event>System initialized.</system>",
		"elements": "<system><event type=\"startup\" severity=\"info\"><value>System initializing...</value><message>Check configuration settings.</message></event><value>System initialized.</value></system>"
	},
	"body": "<system><event type=\"startup\" severity=\"info\"> System initializing...<message>Check configuration settings.</message></event>System initialized.</system>",
	"resource": {...},
	"timestamp": 1733458517830
}

The output includes the bare text nodes wrapped in <value> elements.