ParseSimplifiedXML

Learn about the ParseSimplifiedXML OTTL converter function.

  less than a minute  

The ParseSimplifiedXML converter parses an XML string into structured data. This function is designed for situations where simplicity and readability are prioritized over maintaining the full complexity of the original XML. It excludes attributes, comments, and any text that is not directly an element or a straightforward value. The ParseXML converter maintains the entire structure of the XML document, including attributes, content within tags, and the hierarchy of elements.

Syntax: ParseSimplifiedXML(value)

  • value: the bracket notation location of the XML string to parse

Input

{
	"_type": "log",
	"timestamp": 1734570317034,
	"body": "<log><host>172.17.15.39</host><userIdentifier>68b148de-7ce3-423c-b72d-64a4f21ecfc0</userIdentifier><timeLocal>2024-12-15T22:40:53.723160Z</timeLocal><method>POST</method><request>/styles/main.css</request><protocol>HTTP/2</protocol><status>403</status><bytesSent>1043</bytesSent></log>\n",
	"resource": {...},
	"attributes": {
		"decoded_body": "<log><host>172.17.15.39</host><userIdentifier>68b148de-7ce3-423c-b72d-64a4f21ecfc0</userIdentifier><timeLocal>2024-12-15T22:40:53.723160Z</timeLocal><method>POST</method><request>/styles/main.css</request><protocol>HTTP/2</protocol><status>403</status><bytesSent>1043</bytesSent></log>\n"
	}
}

Statement

set(attributes["map"], ParseSimplifiedXML(attributes["decoded_body"]))

Output

{
	"_type": "log",
	"timestamp": 1734570335844,
	"body": "<log><host>172.17.15.39</host><userIdentifier>68b148de-7ce3-423c-b72d-64a4f21ecfc0</userIdentifier><timeLocal>2024-12-15T22:40:53.723160Z</timeLocal><method>POST</method><request>/styles/main.css</request><protocol>HTTP/2</protocol><status>403</status><bytesSent>1043</bytesSent></log>\n",
	"resource": {...},
	"attributes": {
		"decoded_body": "<log><host>172.17.15.39</host><userIdentifier>68b148de-7ce3-423c-b72d-64a4f21ecfc0</userIdentifier><timeLocal>2024-12-15T22:40:53.723160Z</timeLocal><method>POST</method><request>/styles/main.css</request><protocol>HTTP/2</protocol><status>403</status><bytesSent>1043</bytesSent></log>\n",
		"map": {
			"log": {
				"bytesSent": "1043",
				"host": "172.17.15.39",
				"method": "POST",
				"protocol": "HTTP/2",
				"request": "/styles/main.css",
				"status": "403",
				"timeLocal": "2024-12-15T22:40:53.723160Z",
				"userIdentifier": "68b148de-7ce3-423c-b72d-64a4f21ecfc0"
			}
		}
	}
}

The XML string in decoded_body is parsed into map.