XML Parser

LogViewPlus has a built in XML parser which is capable of analyzing your custom XML log files.  It does this by parsing your XML file according to a template.  A template is a sample XML log entry that has certain fields identified with Conversion Specifiers.

LogViewPlus will not parse an entire log file as XML.  Rather, it will parse the log file line by line while checking the input structure.  Only when the structure represents a complete XML object will a parse be attempted.  This approach allows for monitoring XML log files in tail mode, but may cause issues if your JSON log is a single block of text without new lines.

Because each log entry is parsed separately, our template will only need to match a single log entry.  For example, let's look at a simple XML log enry:

<xml>
   <name firstName="John" lastName="Doe" />
   <employeeId>12345</employeeId>
   <other>ignore</other>
   <dateJoined>2014-05-16 10:50:14,125</dateJoined>
</xml> 

This is a XML log entry with five fields: firstName, lastName, employeedId, other, and dateJoined.  What we need to do is replace the field data with a Conversion Specifier that identifies the field data type.  This might give us the following mapping.

XML Field	Conversion Specifier	LogViewPlus Column
firstName	%S{First Name}	First Name
lastName	%S{Last Name}	Last Name
employeeId	%s{Employee Id}	Employee Id
other		We want to ignore this field.
dateJoined	%d	Date and Time

Therefore, we could parse this XML log entry with the template:

<xml>
	   <name firstName="%S{First Name}" lastName="%S{Last Name}" />
	   <employeeId>%s{Employee Id}</employeeId>
	   <dateJoined>%d</dateJoined>
</xml>

Notice that in the above template the "other" field has been ignored. To ignore a field we simply do not include it in our template.  If one of the elements we were interested in had been a child of a parent node, we would have needed to include the parent node in our template. The important thing is that the template has the full path to the target node.

Once we load this template into LogViewPlus it will appear as:

To do this, we just need to give LogViewPlus our parsing template as an argument for the XML parser.  We can do this in Parser Mappings:

Whitespace will be ignored, so we are free to format the XML as needed.

If our log file contained multiple log entries, LogViewPlus would expect them all to have the same format.  New log entries should also be separated by a new line as discussed above.

Log files parsed with the XML parser support automatic pretty-printing by default.

Finally, notice the similarities between the XML Parser and the JSON Parser.  Both use the concept of templates, so once you have learned one you have basically learned the other.

Parsing Embedded XML

LogViewPlus can parse XML log entries embedded within a parent node.  This process works by recursively scanning through the XML node hierarchy until the root element declared in your conversion pattern is found.  Because XML nodes always contain a root element, no further changes need to be made to your conversion pattern.

In other words, if your log entries are contained in a parent node, you can define your conversion pattern as though the parent node does not exist.  Undefined XML elements are simply ignored.