Is there any documentation for understanding Log parser xml file.
E.g what is the meaning of missField, functions and how can we generate the same output means please tell me the steps in ESA tool so that while creating a parser I can make the changes and this is generated in xml file. I mean to say tagval, missField, functions.
<MESSAGE
id1="CISE_AD_Connector"
id2="CISE_AD_Connector"
eventcategory="########"
tagval="true"
missField="true"
functions="<@msg:*PARMVAL($MSG)><@:*SYSVAL($ID1)><@event_time:*EVNTTIME($HDR,'%W%G%F %H%U%O',hyear,hmonth,hday,hhour,hmin,hsec)><@timezone:*HDR(hfld8)><@hostname:*HDR(hnode)><@id:*HDR(hfld4)><@id1:*HDR(hfld5)><@id2:*HDR(hfld6)><@operation_id:*HDR(hfld10)><@severity:*HDR(hseverity)><@category:*HDR(hfld11)><@event_description:*HDR(hevent_description)>"
content="AD-Domain=<domain>, AD-Domain-Controller=<ac>, AD-IP-Address=<hostip>, AD-Log-Id=<li>, AD-Site=<as>,AD-Trusted-Domain=<at>,AD-Forest=<af>,AD-Error-Details=<result>,AD-Account-Name=<username>,AD-Hostname=<hostname>,AD-Srv-Query=<an>,AD-Srv-Record=<am>"/>
Tagval means that the message is made up of a=1, b=2,c=3 type values.
missField means that if one or more of these entries is missing then it will still parse.
Eg this parser will work on
a=1,c=3
b=2,c=3
a=1
type messages.