parse multiline xmlns in json

[OlesyaShell]

Hi. I have trouble with xmlns parse.
there is a json event with nested xmlns field. Example:
{"data":{"job_id":"692db8c2-9d54-11eb-a8b3-0242ac130003","mime":"application\/eventlog","historical":false,"tag":"wineventlog","input_id":"00000000-0000-0000-0000-000000000000","tenant_id":"00000000-0000-0000-0000-000000000000","body":{"Event":{"System":{"Version":"3","Execution":{"ThreadID":"2680","ProcessID":"1364"},"EventRecordID":"449939","Channel":"Microsoft-Windows-Sysmon\/Operational","Task":"10","EventID":"10","Keywords":"0x8000000000000000","Level":"4","Computer":"a-rs.alpha.local","TimeCreated":{"SystemTime":"2022-12-22T20:43:18.684134900Z"},"Provider":{"Guid":"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}","Name":"Microsoft-Windows-Sysmon"},"Correlation":null,"Security":{"UserID":"S-1-5-18"},"Opcode":"0"},"EventData":{"Data":[{"text":"-","Name":"RuleName"},{"text":"2022-12-22 20:43:18.674","Name":"UtcTime"},{"text":"{e15a5220-c148-63a4-c68a-000000001c00}","Name":"SourceProcessGUID"},{"text":"3788","Name":"SourceProcessId"},{"text":"3732","Name":"SourceThreadId"},{"text":"C:\\Windows\\System32\\Upfc.exe","Name":"SourceImage"},{"text":"{e15a5220-c166-63a4-c88a-000000001c00}","Name":"TargetProcessGUID"},{"text":"356","Name":"TargetProcessId"},{"text":"C:\\Windows\\System32\\sihclient.exe","Name":"TargetImage"},{"text":"0x1fffff","Name":"GrantedAccess"},{"text":"C:\\Windows\\SYSTEM32\\ntdll.dll+a0fb4|C:\\Windows\\System32\\KERNELBASE.dll+47241|C:\\Windows\\System32\\KERNELBASE.dll+46196|C:\\Windows\\System32\\KERNEL32.DLL+1c2e3|C:\\Windows\\System32\\Upfc.exe+3769|C:\\Windows\\System32\\Upfc.exe+da46|C:\\Windows\\System32\\Upfc.exe+dc3f|C:\\Windows\\System32\\Upfc.exe+16d4|C:\\Windows\\System32\\Upfc.exe+1170c|C:\\Windows\\System32\\KERNEL32.DLL+17974|C:\\Windows\\SYSTEM32\\ntdll.dll+6a271","Name":"CallTrace"},{"text":"NT AUTHORITY\\SYSTEM","Name":"SourceUser"},{"text":"NT AUTHORITY\\SYSTEM","Name":"TargetUser"}]},"xmlns":"http:\/\/schemas.microsoft.com\/win\/2004\/08\/events\/event"}},"corrections":{"expected_datetime_formats":["DATETIME_ISO8601","DATETIME_YYYYMMDD_HHMMSS"]},"uuid":"45d01c5b-8239-01ed-8b0c-42149f0148a7","recv_time":"2022-12-22T20:43:21Z"},"id":"45d01c5b-8239-01ed-8b0c-42149f0148a7"}

Vrl don't allowed convert to string this field, apply grok for this field and etc...:

.xmldata = del(.data.body.Event.EventData.Data)
.xmldata = to_string!(.xmldata)
.xmldata = replace(.xmldata, "[", "") #example
parse_groks!( .xmldata, pattern)

In output i see:
ERROR transform{component_kind="transform" component_id=transform-w component_type=remap component_name=transform-w}: vector::internal_events::remap: Mapping failed with event. error="function call error for \"to_string\" at (1813:1833): unable to coerce [{ Name: string, text: string }, { Name: string, text: string }, { Name: string, text: string }, { Name: string, text: string }, { Name: string, text: string }, { Name: string, text: string }, { Name: string, text: string }, { Name: string, text: string }, { Name: string, text: string }, { Name: string, text: string }, { Name: string, text: string }, { Name: string, text: string }, { Name: string, text: string }] into string" error_type="conversion_failed" stage="processing" internal_log_rate_limit=true

Main questions:

1. How can i parse this field?
2. if an error occurs in the configuration file when parsing an event, then the event passes without parsing. How can I make the event honor other transformations in program.vrl ?
   Thx.

[spencergilbert]

Hi @OlesyaShell 👋 ,

How can i parse this field?

You can't to_string() an Array, the possible inputs can be <integer | float | boolean | string | timestamp | null> (ref)

You could use join() to convert the Array to a String and then do additional transformations.

If an error occurs in the configuration file when parsing an event, then the event passes without parsing. How can I make the event honor other transformations in program.vrl ?

The default for drop_on_error is false which is why the events are passed through unchanged. You can set that to true to drop the event, or use reroute_dropped to send them to an alternative component for separate transformations or further review.