That would definitely be acceptable. Could you suggest how I might implement that? I haven't managed to work out how from the specification.
On Mon, 4 Nov 2024 at 17:01, Mike Beckerle <mbecke...@apache.org> wrote: > > You cannot convert data values to element names in DFDL. The best you could > do would be something like: > > <program-call> > <elecutable>/bin/foo</executable> > <arg><name>a0</name><value>arg0</value></arg> > <arg><name>a1</name><value>arg1</value></arg> > ... > </program-call> > > On Mon, Nov 4, 2024 at 11:47 AM simon godden <sgod...@gmail.com> wrote: >> >> I have linux auditd input representing a program call and its >> arguments with data such as this: >> >> type=EXECVE executable=/bin/foo a0=arg1 a1=arg2 a2=arg3 >> >> where the number of arguments is arbitrary >> >> Is it possible to parse this to a representation such as >> >> <program-call> >> <executable>/bin/foo</executable> >> <a0>arg1</a0> >> <a1>arg2</a1> >> <a2>arg3</a2> >> </program-call> >> >> in a way that will also unparse to the original content, and bearing >> in mind that the number of arguments is arbitrary (although we would >> impose a suitable maximum). >> >> -- >> Simon Godden -- Simon Godden
