How to reference fields outside an XML event?

Elastic Stack Logstash
1

Example XML:

<REPORT>
	<RESULTS>
		<EVENT_LIST>
			<EVENT>
				<ID>1</ID>
				<URLS>
					<URL>
						www.google.com
					</URL>
					<URL>
						www.elastic.co
					</URL>
				</URLS>
				...
			</EVENT>
			<EVENT>
				<ID>2</ID>
				<URLS>
					<URL>
						www.google.com
					</URL>
					<URL>
						www.elastic.co
					</URL>
				</URLS>
				...
			</EVENT>
		</EVENT_LIST>
	</RESULTS>
	<INFO>
		<INFO_LIST>
			<ID>
				<ID>1</ID>
				<CATEGORY>A</CATEGORY>
				<DESCRIPTION>This is id 1</DESCRIPTION>
			</ID>
			<ID>
				<ID>2</ID>
				<CATEGORY>B</CATEGORY>
				<DESCRIPTION>This is id 2</DESCRIPTION>
			</ID>
		</INFO_LIST>
	</INFO>
</REPORT>

I've been able to split each event and flatten and parse all the fields in each event using ruby. I would like to include all the fields in 'info' corresponding to the event's id.
So the event would look like

"id" => "1"
"url" => "www.google.com, www.elastic.co"
"category" => "A"
"description" => "This is id 1"

I've tried setting xpath to "/REPORT/INFO/INFO_LIST/ID" and referencing it in the ruby code, but get an undefined variable error. I've also tried adding a field to the xml filter, but with no sucess. Is there a way to reference fields outside of the current event?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.