GetXML

Learn about the GetXML OTTL converter function.

  less than a minute  

The GetXML converter extracts a part of an XML document using an XPath expression.

Syntax: GetXML(xml_string, xpath)

  • xml_string: the bracket notation location of the XML string field
  • xpath: the XPath query to extract the desired XML part

Input

{
	"_type": "log",
	"attributes": {
		"decoded_body": "<log><timestamp>1730511053177</timestamp><level>info</level></log>"
	},
	"body": "<log><timestamp>1730511053177</timestamp><level>info</level></log>",
	"resource": {
		"ed.conf.id": "123456789",
		"ed.domain": "pipeline",
		"ed.org.id": "987654321",
		"ed.source.name": "__ed_dummy_test_input",
		"ed.source.type": "memory_input",
		"ed.tag": "loggen",
		"host.ip": "10.0.0.1",
		"host.name": "ED_TEST",
		"service.name": "ed-tester",
		"src_type": "memory_input"
	},
	"timestamp": 1733787219746
}

Statement

set(attributes["log_level"], GetXML(attributes["decoded_body"], "/log/level"))

Output

{
	"_type": "log",
	"attributes": {
		"decoded_body": "<log><timestamp>1730511053177</timestamp><level>info</level></log>",
		"log_level": "<level>info</level>"
	},
	"body": "<log><timestamp>1730511053177</timestamp><level>info</level></log>",
	"resource": {
		"ed.conf.id": "123456789",
		"ed.domain": "pipeline",
		"ed.org.id": "987654321",
		"ed.source.name": "__ed_dummy_test_input",
		"ed.source.type": "memory_input",
		"ed.tag": "loggen",
		"host.ip": "10.0.0.1",
		"host.name": "ED_TEST",
		"service.name": "ed-tester",
		"src_type": "memory_input"
	},
	"timestamp": 1733787262978
}

The XPath query extracted the log_level XML object from the XML decoded_body.