Retour
-
Titre
Windows XML Parsing Has Additional Whitespaces When Using XML Parser -
Description
Within Windows security logs, some logs contain a single whitespace which is expected, while some hosts log with three whitespaces. -
Cause
A recent change to Microsoft Windows has changed the number of whitespaces within the logs. -
Résolution
Workaround:
A rewrite rule, such as the example below, can help to modify the multiple whitespaces back to a single whitespace:rewrite r_example{ subst("]\s\s\s", "]\s", value("MESSAGE")); };