Unable to extract XML for a search - advice sought.

[mikefapex]

If you have a minute to help, I am trying to search on the: to/ContactURI within the XML found in this result. I have tried several things but it is not working the way I expect/need. This is what I have tried, each without success. No errors, just no results. Thanks for looking

-- No results, no errors
eventtype=dmz_event | rex "(?.*)" | xpath outfield=to_contact "//messageLogType/to/contactURI/contact" | search to_contact="3036561711"

eventtype=dmz_event | rex "(?.)" | xmlkv dmz_xml_text outfield=to_contact "//messageLogType/to/contactURI/contact" | search to_contact="*3036561711"

eventtype=dmz_event | rex "(?.*)" | xpath outfield=to_contact "//messageLogType/to/contactURI/contact" | search to_contact="3036561711"

eventtype=dmz_event | rex "(?.*)" | spath input=dmz_xml_text output=to_contact path="//messageLogType/to/contactURI/contact" | search to_contact="3036561711"

===Sample data

3:52:49.238 PM  2013-06-03 15:52:49,238 [ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'  INFO SEND_MESSAGE_REQ_LOG [] - *Server in-bound request

GET 209.211.75.102:80/AFTelephonyRWS/restful/PHN01/7209959443/call?token=f32226911935a741e7245cf3c1dcf3e7

CORRELATION ID : a556630f-46c9-49d4-aa95-70c6f1665383-MFID-AF_GetSummaryCallLogs_CCS

X-Forwarded-Server: ecomt113.qwest.com

X-Forwarded-For: 174.255.128.245

Accept: application/json

Cookie2: $Version=1

Host: 209.211.75.102

X-Cluster-Client-Ip: 155.70.21.27

Cookie: JSESSIONID=TdY4RtXd1dB8Qsj1JXQjbZkvnh2cvLKgBpLV5T6f2HGQh1ytwpcy!-1767480122

X-Forwarded-Host: ecomt113.qwest.com:50747

Connection: Keep-Alive

Max-Forwards: 10



<?xml version="1.0" encoding="UTF-8"?>



 Hi, My name is SOA Runner. This is a soa automated test.

 

  

   5038333065

   TelURI

  

  SOA Runner

  Automated

 

 

  

   3036561711

   TelURI

  

 

[mikefapex]

Hmmm, that would not surprise me, I'm Regex-dicapped. But trying this still yields no results.

eventtype=dmz_event | rex "< messagetext>(?.*)<\/messagetext>" | xpath outfield=to_contact "//messageLogType/to/contactURI/contact" | search to_contact="3036561711"

eventtype=dmz_event | rex "< messagetext>(?.)<\/messagetext>" | xmlkv dmz_xml_text outfield=to_contact "//messageLogType/to/contactURI/contact" | search to_contact="*3036561711"

[JSapienza · Accepted solution]

At first look , you are not escaping your regex properly.

\< messagetext\>(?< dmz_xml_text >.*)\<\/messagetext\>