XML

Parse

Synopsis

Parses XML-formatted strings into structured maps.

Schema

- xml:
    field: <ident>
    target_field: <ident>
    description: <text>
    if: <script>
    add_to_root: <boolean>
    attribute_prefix: <string>
    compact: <boolean>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y		Field containing the XML string to parse
target_field	N		Field to store the parsed XML structure. If omitted and add_to_root is false, an error is raised
description	N	-	Explanatory note
if	N	-	Conditional expression to determine if processing should occur
add_to_root	N	false	If true, adds parsed XML elements directly to the log entry root
attribute_prefix	N	_	Prefix applied to attribute keys. Attributes become ordinary sibling keys of the element, distinguished only by this prefix
compact	N	false	Collapse the wrapper maps where it is unambiguous. See Compact Mode below
ignore_failure	N	false	Skip processing if an error occurs
ignore_missing	N	false	Skip processing if the source field is missing
on_failure	N	-	Processors to run if processing fails
on_success	N	-	Processors to run after successful processing
tag	N	-	Identifier for logging purposes
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration

Details

The processor converts XML documents into nested map structures, handling complex scenarios like nested elements, attributes, and mixed content.

Every element becomes a map, and the parser uses exactly two conventions:

• Element text goes under the __text key — two underscores. This applies to every element that has text, whether or not it also has attributes, so even a leaf element is a map: <name>John</name> parses to {"name": {"__text": "John"}}, not to the bare string.
• Attributes become ordinary sibling keys prefixed with attribute_prefix (_ by default). <user id="123"> gives the key _id. They are not collected into a separate map.

Repeated elements are converted to arrays. Mixed content preserves both: <message>Hello <b>World</b>!</message> parses to {"message": {"__text": "Hello !", "b": {"__text": "World"}}} — the element's own text is joined with a space and kept alongside the child.

An empty element that carries attributes still gets __text: "", so the key is always present where text was possible.

warning

Invalid XML will cause processing to fail unless ignore_failure is set to true.

Examples

Basic

Parsing a simple XML structure...	{ "xml_data": "<person><name>John</name><age>30</age></person>" } - xml: field: xml_data target_field: parsed_data
creates a structured map:	{ "parsed_data": { "person": { "name": {"__text": "John"}, "age": {"__text": "30"} } } }

Attributes

Parsing XML with element attributes...	{ "xml_data": "<user id=\"123\" type=\"admin\"><name>Alice</name></user>" } - xml: field: xml_data target_field: parsed_data
handles each separately:	{ "parsed_data": { "user": { "_id": "123", "_type": "admin", "name": {"__text": "Alice"} } } }

Repeated Elements

Parsing XML with repeated elements...	{ "xml_data": "<books><book>Book1</book><book>Book2</book></books>" } - xml: field: xml_data target_field: parsed_data
converts repeated elements to arrays:	{ "parsed_data": { "books": { "book": [ {"__text": "Book1"}, {"__text": "Book2"} ] } } }

Adding to Root

Adding parsed XML directly to log entry root...	{ "xml_data": "<data><value>test</value><id>123</id></data>" } - xml: field: xml_data add_to_root: true
adds the elements directly:	{ "data": { "value": {"__text": "test"}, "id": {"__text": "123"} } }

Compact Mode

Windows EventData is the case compact exists for. By default each <Data> element keeps its attribute and its text as separate keys...	{ "xml_data": "<EventData><Data Name=\"AuthenticationPackageName\">Negotiate</Data><Data Name=\"ElevatedToken\">%%1842</Data></EventData>" } - xml: field: xml_data target_field: parsed_data
which leaves an array you have to walk by index:	{ "parsed_data": { "EventData": { "Data": [ {"_Name": "AuthenticationPackageName", "__text": "Negotiate"}, {"_Name": "ElevatedToken", "__text": "%%1842"} ] } } }
With compact: true, an element holding exactly one attribute and its text becomes a single key-value pair, keyed by the attribute value...	- xml: field: xml_data target_field: parsed_data compact: true
giving named fields you can reference directly:	{ "parsed_data": { "EventData": { "Data": { "AuthenticationPackageName": "Negotiate", "ElevatedToken": "%%1842" } } } }

The collapse is deliberately narrow. It applies only where the shape is unambiguous:

• An element with __text and exactly one attribute and nothing else becomes {<attribute value>: <text>}.
• An element with __text and nothing else becomes the bare text string.

Anything else — two attributes, a child element alongside the text — is left as it is. An EventData block mixing <Data Name="..."> with <Data Type="..."> elements does not collapse, because the elements do not share one attribute name.

Complex Nested

Parsing complex XML with nested elements and attributes...	{ "xml_data": "<library><category name=\"fiction\"><book id=\"1\"><title>Book1</title><authors><author>Author1</author><author>Author2</author></authors></book></category></library>" } - xml: field: xml_data target_field: parsed_data
preserves the layout and attributes:	{ "parsed_data": { "library": { "category": { "_name": "fiction", "book": { "_id": "1", "title": {"__text": "Book1"}, "authors": { "author": [ {"__text": "Author1"}, {"__text": "Author2"} ] } } } } } }