1

I finally decided to learn how to parse xml in python. I'm using elementtree just to get a basic understanding. I'm on CentOS 6.5 using python 2.7.9. I've looked through the following pages:

http://www.diveintopython3.net/xml.html

https://pymotw.com/2/xml/etree/ElementTree/parse.html#traversing-the-parsed-tree

and performed several searches on this forum, but I'm having some trouble and I'm not sure if it's my code or the xml I'm trying to parse.

I need to be able to verify if certain elements are in the xml or not. For example, in the xml below, I need to check to see if the element Analyzer is present and if so, get the attribute. Then, if Analyzer is present, I need to check for the location element and get the text then the name element and get that text. I thought that the following code would check to see if the element existed:

if element.find('...') is not None

but that yields inconsistent results and it never seems to find the location or name element. For example:

if tree.find('Alert') is not None:

appears to work, but

if tree.find('location') is not None:

or

if tree.find('Analyzer') is not None:

definitely don't work. I'm guessing that the tree.find() function only works for the top level?

So how do I do this check?

Here is my xml:

<?xml version='1.0' encoding='UTF-8'?>
<Report>
  <Alert>
    <Analyzer analyzerid="CS">
      <Node>
        <location>USA</location>
        <name>John Smith</name>
      </Node>
    </Analyzer>
    <AnalyzerTime>2016-06-11T00:30:02+0000</AnalyzerTime>
    <AdditionalData type="integer" meaning="number of alerts in this report">19</AdditionalData>
    <AdditionalData type="string" meaning="report schedule">5 minutes</AdditionalData>
    <AdditionalData type="string" meaning="report type">alerts</AdditionalData>
    <AdditionalData type="date-time" meaning="report start time">2016-06-11T00:25:16+0000</AdditionalData>
  </Alert>
  <Alert>
    <CreateTime>2016-06-11T00:25:16+0000</CreateTime>
    <Source>
      <Node>
        <Address category="ipv4-addr">
          <address>1.5.1.4</address>
        </Address>
      </Node>
    </Source>
    <Target>
      <Service>
        <port>22</port>
        <protocol>TCP</protocol>
      </Service>
    </Target>
    <Classification text="SSH scans, direction:ingress, confidence:80, severity:high">
      <Reference meaning="Scanning" origin="user-specific">
        <name>SSH Attack</name>
        <url> </url>
      </Reference>
    </Classification>
    <Assessment>
      <Action category="block-installed"/>
    </Assessment>
    <AdditionalData type="string" meaning="top level domain owner">PH, Philippines</AdditionalData>
    <AdditionalData type="integer" meaning="alert threshold">0</AdditionalData>
  </Alert>
</Report>

And here is my code:

import xml.etree.ElementTree as ET
tree = ET.parse('test.xml')
root = tree.getroot()

for child in root: print child

all_links = tree.findall('.//Analyzer')
try:
        print all_links[0].attrib.get('analyzerid')
        ID = all_links[0].attrib.get('analyzerid')
        all_links2 = tree.findall('.//location')
        print all_links2
        try:
                print all_links[0].text
        except:  print "can't print text location"

        if tree.find('location') is None: print 'lost'
        for kid in tree.iter('location'):
                try:
                        location = kid.text
                        print kid.text
                except: print 'bad'

except IndexError: print'There was no Analyzer element'
user1070061
  • 473
  • 2
  • 5
  • 11

1 Answers1

0

I think you're missing one important line from the Dive Into Python tutorial (just up from here):

There is a way to search for descendant elements, i.e. children, grandchildren, and any element at any nesting level.

That way is to precede the element names with //.

tree.find("someElementName") will only find a direct child element of tree with the name someElementName. If you want to search for an element named someElementName anywhere within tree, use tree.find("//someElementName").

The // notation originates from XPath. The ElementTree module provides support for a limited subset of XPath. The ElementTree documentation details the parts of XPath syntax it supports.

Luke Woodward
  • 63,336
  • 16
  • 89
  • 104