That will require a lot of ruby code. The following is incomplete, and has no error checking. It never bothers to check that a field exists before indexing into it, so minor exceptions in the XML format will cause exceptions.
xml { source => "message" target => "theXML" remove_field => [ "message" ] }
ruby {
code => '
oldM = event.get("[theXML][measInfo]")
newM = []
oldM.each { |x|
# Restructure each measInfo
item = {}
item["repPeriod"] = {}
item["repPeriod"]["duration"] = x["repPeriod"][0]["duration"]
types = x["measType"]
oldValues = x["measValue"]
newValues = []
oldValues.each { |y|
value = {}
value["measObjLdn"] = y["measObjLdn"]
if y["suspect"]
value["suspect"] = y["suspect"][0]
end
newStuff = []
y["r"].each { |z|
someName = {}
index = z["p"].to_i - 1
type = types[index]["content"]
someName[type] = z["content"]
newStuff << someName
}
value["r"] = newStuff
newValues << value
}
item["measValue"] = newValues
newM << item
}
event.set("measInfo", newM)
'
}
That will get you something like
"measInfo" => [
[0] {
"repPeriod" => {
"duration" => "PT900S"
},
"measValue" => [
[0] {
"measObjLdn" => "ManagedElement=UXJD6109,Equipment=1,FieldReplaceableUnit=1",
"r" => [
[0] {
"pmPowerFailure" => " "
},
[1] {
"pmUnitTemperatureLevel" => "3,3,3"
}
]
},
[1] {
"measObjLdn" => "ManagedElement=UXJD6109,Equipment=1,FieldReplaceableUnit=RRU-1",
"r" => [
[0] {
"pmPowerFailure" => "0"
},
[1] {
"pmUnitTemperatureLevel" => " , , "
}
]
},