Xml_parsing multiline

[BlackSpy1231]

{ "xml_array": [

                                       "",

                                       "<DoNot xmlns=\http://www.AAMA-google.org/dummy/adms-311/css/aaa\><RefID>123</RefID><device><UNKnown/></device><doNot>false</doNot></DoNot>--UniqueDataType:applicationLength:123",

                                       "<DoNot xmlns=\http://www.AAMA-google.org/dummy/adms-311/css/aaa\><RefID>456</RefID><device><UNKnown/></device><doNot>false</doNot></DoNot>--UniqueDataType:applicationLength:123",

                                       "<DoNot xmlns=\http://www.AAMA-google.org/dummy/adms-311/css/aaa\><RefID>678</RefID><device><UNKnown/></device><doNot>false</doNot></DoNot>--UniqueDataType:applicationLength:123",

                                       "<DoNot xmlns=\http://www.AAMA-google.org/dummy/adms-311/css/aaa\><RefID>345</RefID><device><UNKnown/></device><doNot>false</doNot></DoNot>"

                         ],

}

[transforms.xtrans_events]

type = "remap"

inputs = ["data"]

source ='''

.array= split(string!(.message),"|")



if contains!(.array[-1],"xml version"){

        .xml_data= replace(replace!(.array[-1],"\r\n",""),"\n","")

        . |= flatten!(parse_regex_all!(.xml_data, r'(?P<xml><.?xml version.*>)')[0])        

        .xml_array= split(string!(.xml),"<?xml version=\"1.0\" encoding=\"UTF-8\"?>")

        for_each(.xml_array) -> |index, value| {

           

            if match(value, r'<.*>'){

                . |= flatten!(parse_regex_all!(value, r'(?P<xml_1><.*>)')[0])

                . |= flatten!(parse_xml!(string!(.xml_1), parse_number: true,include_attr :true))

            }

        }



   

}

expected output

{"DoNot.RefID_1":123,

"DoNot.RefID_2":456,

"DoNot.RefID_3":678,

"DoNot.RefID_4":345} @tobz
demo.txt

[tobz]

What's the actual output that you get?

[BlackSpy1231]

Sorry @tobz i can't enter complete sentence so only i have share you text document please have a look

[BlackSpy1231]

I would start by removing everything in the remap after the split call, and then change it to . = split(...) so that the remap emits multiple events, one for each portion of the input string that was split.
@tobz no its not splitting PHONE:NUMBER:98746488\n\n\BYTES10938\r\nNOTIFY<?xml version="1.0" encoding="UTF-8"?><DoNot xmlns="http://www.AAMA-google.org/dummy/adms-311/css/aaa"><RefID>456</RefID><device><UNKnown/></device><doNot>false</doNot></DoNot> i have data something like this if i split with space i want to remove from phone to notify then only i can use parse_xml
That will let you understand what the split strings look like, and what the last array value is, and if it actually contains the XML fragments that you expect it to contain.

[tobz]

Sorry @BlackSpy1231, I'm not entirely sure what you're saying.

I think at this point, we need to take a step back. Please update your original post with the following:

• the entire Vector configuration (not just the transform, with any private information redacted, etc)
• a single input event that you're trying to process (it appears your file has multiple)
• the expected output for your configuration (you already have this, so no worries)
• the actual output you're getting

You may end up wanting to use a file source and console sink in order to feed the input data as a file, while writing the transform output to console, as this will make it easier to debug, as well as making the problem reproducible. Without a reproducible configuration, we cannot ourselves attempt to examine your problem and can only provide cursory support based on the information we're given.

[BlackSpy1231]

@tobz just forget about multiline i want to parse this single data , similar kind of output i'm expecting
demo (2).txt

[tobz]

A large part of our ability to provide support to the community involves users meeting us half-way by submitting reproducible examples of their problems, along with any requested information that we need in order to understand the issue.

As such, I'll be unable to help you any further until all of the information that I requested in my last response is provided.