XML Output Format Document Structures

Log Parser

previous page next page

XML Output Format Document Structures

The XML output format generates XML documents that can be structured in four different ways, depending on the value specified for the structure parameter.

Structure 1

When the "structure" parameter is set to "1", the XML output format creates a node named "ROW" for each output record.
This node in turn contains nodes for each field in the output record, named after the field names and with node values containing the field values.

The following example shows an XML document created with structure "1": 

<?xml version="1.0" encoding="ISO-10646-UCS-2" standalone="yes" ?>
<!DOCTYPE ROOT[
 <!ATTLIST ROOT DATE_CREATED CDATA #REQUIRED>
 <!ATTLIST ROOT CREATED_BY CDATA #REQUIRED>
 <!ELEMENT TimeGenerated (#PCDATA)>
 <!ELEMENT SourceName (#PCDATA)>
 <!ELEMENT EventID (#PCDATA)>
 <!ELEMENT Message (#PCDATA)>
 <!ELEMENT ROW (TimeGenerated, SourceName, EventID, Message)>
 <!ELEMENT ROOT (ROW*)>
]>
<ROOT DATE_CREATED="2004-11-08 17:36:44" CREATED_BY="Microsoft Log Parser V2.2">
 <ROW>
  <TimeGenerated>
  2004-04-18 18:48:04
  </TimeGenerated>
  <SourceName>
  EventLog
  </SourceName>
  <EventID>
  6009
  </EventID>
  <Message>
  Microsoft (R) Windows (R) 5.01. 2600 Service Pack 1 Uniprocessor Free. 
  </Message>
 </ROW>
 <ROW>
  <TimeGenerated>
  2004-04-18 18:48:04
  </TimeGenerated>
  <SourceName>
  EventLog
  </SourceName>
  <EventID>
  6005
  </EventID>
  <Message>
  The Event log service was started. 
  </Message>
 </ROW>
</ROOT>

Structure 2

Setting the "structure" parameter to "2" causes the XML output format to generate XML documents that are formatted according to structure "1", and in which field nodes have a "TYPE" attribute that specifies the data type of the corresponding output record field.

The following example shows an XML document created with structure "2": 

<?xml version="1.0" encoding="ISO-10646-UCS-2" standalone="yes" ?>
<!DOCTYPE ROOT[
 <!ATTLIST ROOT DATE_CREATED CDATA #REQUIRED>
 <!ATTLIST ROOT CREATED_BY CDATA #REQUIRED>
 <!ELEMENT TimeGenerated (#PCDATA)>
 <!ATTLIST TimeGenerated TYPE CDATA #REQUIRED>
 <!ELEMENT SourceName (#PCDATA)>
 <!ATTLIST SourceName TYPE CDATA #REQUIRED>
 <!ELEMENT EventID (#PCDATA)>
 <!ATTLIST EventID TYPE CDATA #REQUIRED>
 <!ELEMENT Message (#PCDATA)>
 <!ATTLIST Message TYPE CDATA #REQUIRED>
 <!ELEMENT ROW (TimeGenerated, SourceName, EventID, Message)>
 <!ELEMENT ROOT (ROW*)>
]>
<ROOT DATE_CREATED="2004-11-08 17:30:25" CREATED_BY="Microsoft Log Parser V2.2">
 <ROW>
  <TimeGenerated TYPE="TIMESTAMP">
  2004-04-18 18:48:04
  </TimeGenerated>
  <SourceName TYPE="STRING">
  EventLog
  </SourceName>
  <EventID TYPE="INTEGER">
  6009
  </EventID>
  <Message TYPE="STRING">
  Microsoft (R) Windows (R) 5.01. 2600 Service Pack 1 Uniprocessor Free. 
  </Message>
 </ROW>
 <ROW>
  <TimeGenerated TYPE="TIMESTAMP">
  2004-04-18 18:48:04
  </TimeGenerated>
  <SourceName TYPE="STRING">
  EventLog
  </SourceName>
  <EventID TYPE="INTEGER">
  6005
  </EventID>
  <Message TYPE="STRING">
  The Event log service was started. 
  </Message>
 </ROW>
</ROOT>

Structure 3

When the "structure" parameter is set to "3", the XML output format creates a node named "ROW" for each output record.
This node in turn contains nodes named "FIELD" for each field in the output record; each "FIELD" node has a node value equal to the field value, and a "NAME" attribute that specifies the field name.

The following example shows an XML document created with structure "3": 

<?xml version="1.0" encoding="ISO-10646-UCS-2" standalone="yes" ?>
<!DOCTYPE ROOT[
 <!ATTLIST ROOT DATE_CREATED CDATA #REQUIRED>
 <!ATTLIST ROOT CREATED_BY CDATA #REQUIRED>
 <!ELEMENT FIELD (#PCDATA)>
 <!ATTLIST FIELD NAME CDATA #REQUIRED>
 <!ELEMENT ROW (FIELD, FIELD, FIELD, FIELD)>
 <!ELEMENT ROOT (ROW*)>
]>
<ROOT DATE_CREATED="2004-11-08 17:32:41" CREATED_BY="Microsoft Log Parser V2.2">
 <ROW>
  <FIELD NAME="TimeGenerated">
  2004-04-18 18:48:04
  </FIELD>
  <FIELD NAME="SourceName">
  EventLog
  </FIELD>
  <FIELD NAME="EventID">
  6009
  </FIELD>
  <FIELD NAME="Message">
  Microsoft (R) Windows (R) 5.01. 2600 Service Pack 1 Uniprocessor Free. 
  </FIELD>
 </ROW>
 <ROW>
  <FIELD NAME="TimeGenerated">
  2004-04-18 18:48:04
  </FIELD>
  <FIELD NAME="SourceName">
  EventLog
  </FIELD>
  <FIELD NAME="EventID">
  6005
  </FIELD>
  <FIELD NAME="Message">
  The Event log service was started. 
  </FIELD>
 </ROW>
</ROOT>

Structure 4

Setting the "structure" parameter to "4" causes the XML output format to generate XML documents that are formatted according to structure "3", and in which "FIELD" nodes have an additional "TYPE" attribute that specifies the data type of the corresponding output record field.

The following example shows an XML document created with structure "4": 

<?xml version="1.0" encoding="ISO-10646-UCS-2" standalone="yes" ?>
<!DOCTYPE ROOT[
 <!ATTLIST ROOT DATE_CREATED CDATA #REQUIRED>
 <!ATTLIST ROOT CREATED_BY CDATA #REQUIRED>
 <!ELEMENT FIELD (#PCDATA)>
 <!ATTLIST FIELD NAME CDATA #REQUIRED>
 <!ATTLIST FIELD TYPE CDATA #REQUIRED>
 <!ELEMENT ROW (FIELD, FIELD, FIELD, FIELD)>
 <!ELEMENT ROOT (ROW*)>
]>
<ROOT DATE_CREATED="2004-11-08 17:35:04" CREATED_BY="Microsoft Log Parser V2.2">
 <ROW>
  <FIELD NAME="TimeGenerated" TYPE="TIMESTAMP">
  2004-04-18 18:48:04
  </FIELD>
  <FIELD NAME="SourceName" TYPE="STRING">
  EventLog
  </FIELD>
  <FIELD NAME="EventID" TYPE="INTEGER">
  6009
  </FIELD>
  <FIELD NAME="Message" TYPE="STRING">
  Microsoft (R) Windows (R) 5.01. 2600 Service Pack 1 Uniprocessor Free. 
  </FIELD>
 </ROW>
 <ROW>
  <FIELD NAME="TimeGenerated" TYPE="TIMESTAMP">
  2004-04-18 18:48:04
  </FIELD>
  <FIELD NAME="SourceName" TYPE="STRING">
  EventLog
  </FIELD>
  <FIELD NAME="EventID" TYPE="INTEGER">
  6005
  </FIELD>
  <FIELD NAME="Message" TYPE="STRING">
  The Event log service was started. 
  </FIELD>
 </ROW>
</ROOT>

© 2004 Microsoft Corporation. All rights reserved.

previous page start next page