Parse XML
Parses an XML document string from a field you choose and writes it back as a structured map of tags, attributes, and content. Use it when telemetry carries a serialized XML document (an audit log, a Windows event, an application payload) that you want to turn into addressable fields for querying and filtering.
Supported Telemetry Types
✓
✓
✓
Choose Telemetry Type picks one signal per processor instance. Add another instance to handle a second signal.
Configuration
Basic Configuration

When to apply
Choose Telemetry Type
Telemetry Selector
Yes
Logs
The signal this instance runs on: Logs, Metrics, or Traces (one at a time).
Condition
OTTL Condition
No
(empty)
Parse only the records that match. Empty runs on every record.
Source and target fields
Source Field Type
Enum: Resource, Attribute, Body, Custom
Yes
Attribute
Where the XML string is read from. Body is logs-only. Custom gives access to the full record (any OTTL path).
Source Field
OTTL Field
Yes *
—
The field holding the XML. Use bracket notation for nested fields (e.g. parent["child"]). For a Body source, leave empty to use the whole body.
Target Field Type
Enum: Resource, Attribute, Body, Custom
Yes
Attribute
Where the parsed map is written. Body is logs-only.
Target Field
OTTL Field
Yes *
—
Destination for the parsed map. Leave empty to merge the parsed XML into the chosen context (resource, attributes, or body).
* The Body field type is the exception: it's optional, and leaving it empty targets the entire body.
Body is available for Logs only. For Metrics and Traces, the Source and Target Field Type options are Resource, Attribute, and Custom.
How parsed XML is structured
The processor converts each XML element into a map with these fields:
The element's character data is trimmed and placed in a
contentfield.The element's tag name is trimmed and placed in a
tagfield.The element's attributes are placed as a mapping of attribute name to attribute value in an
attributesfield.Processing instructions, directives, and comments are ignored and not represented in the parsed output.
Child XML elements are parsed the same way and placed in an array in a
childrenfield.
For example, this XML:
parses to:
Examples
Parse an XML audit log from the body into an attribute
Suppose a log carries a serialized XML audit record in its body and you want it as structured fields under the parsed_xml attribute.
Sample input log record:
Configure the processor as:
Choose Telemetry Type:
LogsCondition: leave empty (parse every record)
Source Field Type:
BodySource Field: leave empty (use the whole body)
Target Field Type:
AttributeTarget Field:
parsed_xml
After parsing, the record looks like:
Configuration Tips
It's common for XML to span multiple lines. When reading XML logs from a file, configure the multiline section of the File source so the collector reads the whole XML document as a single entry before this processor runs.
Leaving the Target Field empty merges the parsed map into the selected context (resource, attributes, or body) rather than nesting it under a named field.
Set a Condition to skip records that don't carry XML, for example to avoid re-parsing records the processor has already turned into a map.
Troubleshooting
The target field is empty or unchanged
Symptoms: nothing structured is written to the target after the processor runs.
Solutions:
Confirm the Source Field actually holds a valid XML string and the Condition evaluates true.
For a Body source, verify the field path, or leave Source Field empty to parse the entire body.
Multi-line XML is truncated
Symptoms: only the first line of an XML document is parsed, or parsing fails.
Solutions:
Configure the multiline section of the File source so each XML document is read as one entry.
Verify the source field contains the complete document, not a fragment.
Standalone Processor
Related Resources
Bindplane Resources
These XML processors are designed to work together. Chain them to extract, parse, normalize, and reshape XML end to end:
Last updated
Was this helpful?