# Help in parsing XML data in logstash in different events
**URL:** https://discuss.elastic.co/t/help-in-parsing-xml-data-in-logstash-in-different-events/95322
**Category:** Logstash
**Created:** [August 1, 2017, 10:59am UTC](https://discuss.elastic.co/t/help-in-parsing-xml-data-in-logstash-in-different-events/95322 "2017-08-01T10:59:04Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@aashishchauhan06](https://discuss.elastic.co/u/aashishchauhan06)
#### Post date: [August 1, 2017, 10:59am UTC](https://discuss.elastic.co/t/help-in-parsing-xml-data-in-logstash-in-different-events/95322/1 "2017-08-01T10:59:04Z")
Hello,
I need to parse a xml file data in logstash. I had been able to parse data successfully in same event but i want data in different event.
My XML file looks like:
\< drugbank\>
\< drug type="biotech"\>
\< name\>Lepirudin\< /name\>
\< description\>Lepirudin is identical to natural hirudin except for substitution of leucine\< /description \>
\< drug type="biotech"\>
\< name\>Cetuximab\< /name\>
\< description\>Epidermal growth factor receptor binding FAB. \< /description\>
\< /drug\>
\< /drugbank\>
and my config file looks like:
input
{
file {
path =\> "...path/sampledrugbank.xml"
type =\> "test\_drugbank"
start\_position =\> beginning
sincedb\_path =\> "/dev/null"
codec =\> multiline
{
pattern =\> "^\"
negate =\> true
what =\> "previous"
}
}
}
filter {
xml {
source =\> "message"
force\_array =\> false
xpath =\> [
"/drugbank/drug/name/text()", "name",
"/drugbank/drug/description/text()", "description"
]
target =\> "doc"
store\_xml =\> true
}}
output
{
elasticsearch {
codec =\> json
hosts =\> "0.0.0.0"
index =\> "drugbank\_index"
}}
Currently i'm getting output in single event as:
{
"name": ["Lepirudin", "Cetuximab"]
"description": ["Lepirudin is identical to natural hirudin except for substitution of leucine for isoleucine , "Epidermal growth factor receptor binding FAB."]
}
but i want output as:
{
"name": "Lepirudin",
"description": "Lepirudin is identical to natural hirudin except for substitution of leucine for isoleucine
},
{
"name": "Cetuximab",
"description": "Epidermal growth factor receptor binding FAB."
}
Sometimes logstash didn't create index as well even after successful compilation. Help me with this configuration.
Thanks
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 3, 2017, 11:56am UTC](https://discuss.elastic.co/t/help-in-parsing-xml-data-in-logstash-in-different-events/95322/2 "2017-08-03T11:56:10Z")
You need to use a ruby filter. Ruby's transpose function makes it easy to turn your two input arrays (the `name` and `description` fields) into an array that looks like this:
> [["Lepirudin", "Lepirudin is identical to natural hirudin except for substitution of leucine for isoleucine"], ["Cetuximab", "Epidermal growth factor receptor binding FAB."]]
See [ruby - How to unzip an Array? - Stack Overflow](https://stackoverflow.com/questions/15754158/how-to-unzip-an-array) for an example.
The result above can then easily be transformed into an array of objects with `name` and `description` fields, and if you want them to reside in different event you can use a split filter to splice the values in the array into multiple events.
I don't have time to provide a complete example.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 31, 2017, 11:56am UTC](https://discuss.elastic.co/t/help-in-parsing-xml-data-in-logstash-in-different-events/95322/3 "2017-08-31T11:56:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.