Parsing Alienvault xml logs

I'm looking to parse out the specific fields indicated in each entry id tag.

<?xml version='1.0' encoding='ISO-8859-1' ?><log>
<sign type='' digest='' />
<entry id='' v='' fdate='' date='' plugin_id='' sensor='' src_ip='' dst_ip='' src_port='' dst_port='' tzone='' datalen='' data='' plugin_sid='' proto=''  ctx='' src_host='' dst_host='' src_net='' dst_net='' username='' userdata1='' userdata2='' userdata3='' userdata4='' userdata5='' userdata9='' idm_host_src='' idm_host_dst='' idm_mac_src='' idm_mac_dst='' device=''/>

Any examples of what you would refer to in the xml filter to identify available fields would be extremely helpful.

Interesting, it's all one large XML element with lots of attributes? In any case, the XML filter with xpath should probably get you going.

This is a good place to start if you're unfamiliar with XPath.

Given that this doesn't conform to your logs format, here's a simple example

Example XML


Example Filter

filter {
  xml {
    xpath => [
      "top/topdata/text()", "Top Data",
      "top/middle/bottom/bottomdata/text()", "Bottom Data"

Resulting Fields
Top Data: 1
Bottom Data: 20

Thanks so much @wwalker

This is exactly what I was looking for.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.