I have XML in the following format that just refuses to break where I want it to --
<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
<Property Name="PSComputerName" Type="System.String">name.domain.com</Property>
<Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
<Property Name="ObjectModified" Type="System.String">domain.com/My DL's/National Sales</Property>
<Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
<Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
<Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
</Property>
<Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
<Property Name="Caller" Type="System.String">domain.com/MyAdmins/My IFS/Teddybear</Property>
<Property Name="Succeeded" Type="System.Boolean">True</Property>
<Property Name="Error" Type="System.String">None</Property>
<Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:03 PM</Property>
<Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
<Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv258AAAJ</Property>
<Property Name="IsValid" Type="System.Boolean">True</Property>
</Object>
<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
<Property Name="PSComputerName" Type="System.String">name.domain.com\x
00</Property>
<Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
<Property Name="ObjectModified" Type="System.String">server.com/My DL's/Self Service/Engineering Communications</Property>
<Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
<Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
<Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
</Property>
<Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
<Property Name="Caller" Type="System.String">name.com/MyAdmins/My IFS/Teddybear</Property>
<Property Name="Succeeded" Type="System.Boolean">True</Property>
<Property Name="Error" Type="System.String">None</Property>
<Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:02 PM</Property>
<Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
<Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv257AAAJ</Property>
<Property Name="IsValid" Type="System.Boolean">True</Property>
</Object>
My props.conf:
[my_xml]
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = False
MAX_TIMESTAMP_LOOKAHEAD = 500
TIME_PREFIX = (?m)\s* Type="System.DateTime">
LINE_BREAKER = </Object>(\s*)<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
I don't see a tag called <Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
in your sample data? Either it's just omitted in the sample or it's the cause of why the LINE_BREAKER
won't apply.
Perhaps you've misplaced it on the line above. I don't think TIME_PREFIX require a multiline specification.
/k
I'm not entirely sure whether the \s
you're matching on will match newlines as well by default. Might want to try putting a (?ms)
at the start of the regex.
Sorry I just updated the sample with the correct one. I'm using various samples to get this to work.