XML parser configuration does not handle colon (:) in node/element names


Author
Message
radix
radix
New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)
Group: Forum Members
Posts: 4, Visits: 8
I'm evaluating v2.6.3, and creating a custom XML Parser.
Using the example for configuring the XML Parser [but with the root node updated to <xml:xxx>], adding any conversion specifier does not create an entry in the column/value table.

To illustrate, here's my Parser Configuration entry with a conversion specifier for 'firstName':
<xml:xxx>
  <name firstName="%S{First}" lastName="Doe"/>
  <employeeId>12345</employeeId>
  <other attr1="ignore">ignore</other>
  <dateJoined>2014-05-16 10:50:14,125</dateJoined>
</xml:xxx>

The example works fine without the ':xxx' in the node name.
Background: I am trying to create a custom parser for Log4jXml, extended to include call-site and exception details. Nodes and elements in this format all begin with 'log4j:'.
LogViewPlus Support
LogViewPlus Support
Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)
Group: Moderators
Posts: 1.1K, Visits: 3.7K
Hi Radix,

You seem to be having a problem parsing the XML namespace.  Try declaring the parser template without the namespace declarations - "xml:".   Also, nodes in the parser template which do not contain relevant information should be removed.

So for the example you provided, you could simplify it to just:
<xxx>
<name firstName="%S{First}"/>
</xxx>

Hopefully that makes sense.  If you are able to provide a sample log entry, I would be happy to provide an appropriate configuration.

Hope that helps,

Toby

radix
radix
New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)
Group: Forum Members
Posts: 4, Visits: 8
Partial success. By removing the 'log4j:' namespace prefix, I was able to configure the XML parser thus:
<event logger="%c" level="%p" timestamp="%d{Elapsed}" thread="%t">
<message>%m</message>
<throwable>
<![CDATA[%S{Exception}]]>
</throwable>
<properties>
<data name="log4japp" value="%S{App}"/>
<data name="log4jmachinename" value="%S{Host}"/>
</properties>
</event>


However, this configuration does not show any of my events. Here's one (albeit without the exception field)
<log4j:event logger="CommunicationsService.CommsService" level="DEBUG" timestamp="1652286872412" thread="28">
<log4j:message>Service 'CommunicationsServer-3733447a' stopped</log4j:message>
<log4j:properties>
<log4j:data name="log4japp" value="Communications Service.exe(20776)" />
    <log4j:data name="log4jmachinename" value="RDX-L0122" />
</log4j:properties>
</log4j:event>


Switching to the built-in Log4XmlParser does work, but doesn't show the extra fields I'm after.
LogViewPlus Support
LogViewPlus Support
Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)
Group: Moderators
Posts: 1.1K, Visits: 3.7K
Thanks for the update Radix.

Unfortunately there appears to be a bug in LogViewPlus where namespaces are not being processed correctly. 

I have been able to resolve the issue.  This is a serious bug, so we will prioritize the release, but it will still be a few weeks before we are able to get this fix out.  I will post back here when a BETA release is available.

In the meantime, I can suggest two workarounds:
1.  Use the built in Log4XmlParser.
2.  Remove all references to "log4j:" from the file.  With a bit of scripting, this could be done as an open action.

I realize that both of those workarounds are poor substitutes.  We will be releasing this bug fix as soon as we can.

Thanks for reporting this issue.

Toby
radix
radix
New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)
Group: Forum Members
Posts: 4, Visits: 8
Thanks for the assistance, and I look forward to trying out the beta when released.

For now I'll stick with the built-in Log4XmlParser. Since my log source is UDP, I don't think I can use an open action successfully.
LogViewPlus Support
LogViewPlus Support
Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)
Group: Moderators
Posts: 1.1K, Visits: 3.7K
Hi Radix,

I just wanted to let you know that we have now released LogViewPlus v2.6.5 as a BETA release.

This release addresses the XML namespace issue discussed above.

Thanks again for bringing this issue to our attention. Please do let me know if you have any further questions or issues.

Toby
radix
radix
New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)New Member (13 reputation)
Group: Forum Members
Posts: 4, Visits: 8
Thanks Toby, that seems to work for me now.
LogViewPlus Support
LogViewPlus Support
Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)Prestige User (3.9K reputation)
Group: Moderators
Posts: 1.1K, Visits: 3.7K
Glad to hear it Radix - thanks for letting me know!
GO

Merge Selected

Merge into selected topic...



Merge into merge target...



Merge into a specific topic ID...




Similar Topics

Login

Explore
Messages
Mentions
Search