# Filtering and Processing XML Logs in Logstash for JSON Conversion

**URL:** <https://discuss.elastic.co/t/filtering-and-processing-xml-logs-in-logstash-for-json-conversion/362515>\
**Category:** Logstash\
**Created:** [July 4, 2024, 5:56am UTC](https://discuss.elastic.co/t/filtering-and-processing-xml-logs-in-logstash-for-json-conversion/362515 "2024-07-04T05:56:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ayushyadav685](https://avatars.discourse-cdn.com/v4/letter/a/8baadc/32.png) [@ayushyadav685](https://discuss.elastic.co/u/ayushyadav685)\
**Post date:** [July 4, 2024, 5:56am UTC](https://discuss.elastic.co/t/filtering-and-processing-xml-logs-in-logstash-for-json-conversion/362515/1 "2024-07-04T05:56:18Z")

</div>

Hi All,

I want to use only a few parameterized XML tags to convert into JSON and remove all other parameterized tags before processing.

My XML log looks like this:

```xml
<a>
    <b direction="outgoing">
      <c id="0" value="1"/>
      <c id="3" value="2"/>
      <c id="4" value="3"/>
      <c id="11" value="4"/>
      <c id="12" value="5"/>
    </b>
</a>

```

I only need the tags with `id=0` and `id=3` and want to remove the remaining tags before processing the XML log for JSON migration.

This is how my XML logs should be processed:

```xml
<a>
    <b direction="outgoing">
      <c id="0" value="1"/>
      <c id="3" value="2"/>
    </b>
</a>

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 4, 2024, 11:43am UTC](https://discuss.elastic.co/t/filtering-and-processing-xml-logs-in-logstash-for-json-conversion/362515/2 "2024-07-04T11:43:19Z")

</div>

You could try something like

```
    xml {
        source => "message"
        store_xml => true
        target => "theXML"
        force_array => false
    }
    ruby {
        code => '
            xml = event.get("theXML")
            c = xml["b"]["c"]
            if c.is_a? Array
                keep = ["0", "3"]
                c.each_with_index { |x, i|
                    unless keep.include? x[id]
                        event.remove("[theXML][b][c][#{i}]")
                    end
                }
            end
        '
    }

```