Hi, I am trying to extract the field tags and values between the interceptor and \Interceptor tags but am not able to, a sample of the xml is below,
<Interceptor>
<AttackCoords>-80.24185962413824,25.24598123976225</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>5</Infiltrators>
<Enforcer>Baleineau</Enforcer>
<ActionDate>2013-07-05</ActionDate>
<ActionTime>06:15:00</ActionTime>
<RecordNotes>
Infiltrators: Izar Carrillo, Bartolo Gracia, Xevera Lerma, Flaca Santiago, Xaviera Villalpando
</RecordNotes>
<NumEscaped>0</NumEscaped>
<LaunchCoords/>
<AttackVessel>Raft</AttackVessel>
</Interceptor>
my props.conf and transforms.conf looks like the following
[dreamcrusher]
BREAK_ONLY_BEFORE =
DATETIME_CONFIG =
NO_BINARY_CHECK = true
category = Custom
pulldown_type = true
PREAMBLE_REGEX = (<\?xml.*||<.*dataroot>)
SEDCMD-dr = s/<\/dataroot>//g
TIME_FORMAT = %Y-%m-%d%n%H:%M:%S
TIME_PREFIX =
MAX_DAYS_AGO = 5000
REPORT-fieldvalues = field
disabled = false
LINE_BREAKER =
TRUNCATE =
[field]
CLEAN_KEYS = 0
REGEX = <(\w+)>([^<]+)
FORMAT=$1::$2
MV_ADD = true
upon ingesting the event data, I can not see any search time fields being extracted and i am not sure where I am going wrong, gone through many similar posts and have tried a few things but no luck unfortunately, am i doing something incorrect with my props and transform conf files? please do enlighten me!
Any help would be greatly appreciated!
Hi,
Are you using single instance or distributed environment? Where you are putting props and transforms?