Winlogbeat Script Processor - processing xml data

Elastic Stack Beats
1

Trying to add a new javascript processor using the processors section for the Winlogbeat that is reading the Windows Application log events. The custom javascript processor needs to read out an xml from within the actual log event and then pick a certain property (node) to fetch its value.

Tried using the DOMParser.parseFromString but didn't work at all.

What is the best way to do this in this custom script processor that is tied with the Application type event log?
This idea is based of how the winlogbeat\module\powershell\winlogbeat-powershell.js OR the sysmon.js etc.
Trying to do something similar using the application.js file, but unable to parse data from the xml in the event.
Any help / suggestion would be appreciated.

2

The script processor supports only features of EMCAScript 5.1. It doesn't have any of the APIs that you might see supported by browsers or nodejs.

If you need to parse arbitrary XML then use the decode_xml processor.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.