Use the xmlextract command to obtain excerpts of an existing field using XPath from an XML document. The command captures the resulting excerpt into a virtual field.


The xmlextract command cannot operate on the Original Log Content field. Default field, if not specified, is Message. The extracted field has a string, number or a list data type.

To be able to use the xmlextract command on the value of Original Log Content field, first copy the Original Log Content field into a string field, and then run xmlextract on the new string field.


xmlextract field = <field_to_parse> <new_field_name> = <XPath>


The following table lists the parameters used in this command, along with their descriptions.

Parameter Description


Specify the existing field that must be parsed using the XPath.


Specify the virtual field into which the excerpt of the existing field must be captured.


Specify the XPath where the information for the virtual field can be obtained.

XPath expressions always refer to an XML document.

XPath expressions can use the complete path as in (/root/store/books/book)[1]/title or an abbreviated path as in (//title)[1]. For more information on XPath, see XML Path Language.

The following example uses the xmlextract command to find the title of the first book in the XML document:

* | xmlextract field = Store title = '(//title)[1]'