# I need some help to parse the attached xml in Logstash using a ruby filter

**URL:** https://discuss.elastic.co/t/i-need-some-help-to-parse-the-attached-xml-in-logstash-using-a-ruby-filter/381620
**Category:** Logstash
**Created:** [September 5, 2025, 3:33am UTC](https://discuss.elastic.co/t/i-need-some-help-to-parse-the-attached-xml-in-logstash-using-a-ruby-filter/381620 "2025-09-05T03:33:34Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![lester\_slee](https://avatars.discourse-cdn.com/v4/letter/l/47e85d/32.png) [@lester\_slee](https://discuss.elastic.co/u/lester_slee)
#### Post date: [September 5, 2025, 3:33am UTC](https://discuss.elastic.co/t/i-need-some-help-to-parse-the-attached-xml-in-logstash-using-a-ruby-filter/381620/1 "2025-09-05T03:33:34Z")

</div>

I have xml being received in to logstash via an http input and the message can contain one or more documents that need to be indexed separately which is ok. The part I need help with is the within each document there are 1 or more elements with the same name but different values that need to be put into an array. Below is an example of the xml message:

```auto
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<crawl-urls>
    <crawl-url enqueue-type="reenqueued" forced-vse-key="GROUP_NAME_1" forced-vse-key-normalized="forced-vse-key-normalized" status="complete" synchronization="indexed" url="GROUP_NAME">
        <curl-option name="default-allow">allow</curl-option>
        <crawl-data content-type="application/vxml-unnormalized" encoding="xml">
            <document>
                <content name="GroupName">GROUP_NAME_1</content>
                <content name="QID">ABCD12</content>
                <content name="QID">ABCD13</content>
                <content name="QID">ABCD14</content>
            </document>
        </crawl-data>
    </crawl-url>
	<crawl-url enqueue-type="reenqueued" forced-vse-key="GROUP_NAME_2" forced-vse-key-normalized="forced-vse-key-normalized" status="complete" synchronization="indexed" url="GROUP_NAME">
        <curl-option name="default-allow">allow</curl-option>
        <crawl-data content-type="application/vxml-unnormalized" encoding="xml">
            <document>
                <content name="GroupName">GROUP_NAME_2</content>
                <content name="QID">ABCD22</content>
                <content name="QID">ABCD23</content>
                <content name="QID">ABCD24</content>
                <content name="QID">ABCD25</content>
            </document>
        </crawl-data>
    </crawl-url>
</crawl-urls>

```

The output needs to be:

[{“GroupName” : “GROUP\_NAME\_1”},{“QID”:[“ABCD12”,”ABCD13”,”ABCD14”]}]

[{“GroupName” : “GROUP\_NAME\_2”},{“QID”:[“ABCD22”,”ABCD23”,”ABCD24”,”ABCD25”]}]

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 5, 2025, 4:26pm UTC](https://discuss.elastic.co/t/i-need-some-help-to-parse-the-attached-xml-in-logstash-using-a-ruby-filter/381620/2 "2025-09-05T16:26:58Z")

</div>

You could try

```auto
    xml { source => "message" target => "[@metadata][theXML]" force_array => false remove_field => ["message"] }
    split { field => "[@metadata][theXML][crawl-url]" }
    ruby {
        code => '
            c = event.get("[@metadata][theXML][crawl-url][crawl-data][document][content]")
            c.each do |v|
                field = v["name"]
                value = v["content"]
                if event.include?(field)
                    a = Array(event.get(field))
                    a << value
                    event.set(field, a)
                else
                    event.set(field, value)
                end
            end
        '
    }

```

---

<div class="post-metadata">

### Author: ![lester\_slee](https://avatars.discourse-cdn.com/v4/letter/l/47e85d/32.png) [@lester\_slee](https://discuss.elastic.co/u/lester_slee)
#### Post date: [September 8, 2025, 2:51am UTC](https://discuss.elastic.co/t/i-need-some-help-to-parse-the-attached-xml-in-logstash-using-a-ruby-filter/381620/3 "2025-09-08T02:51:34Z")

</div>

Thanks Badger,

That did the job perfectly. So much easier than what I was trying to do all in Ruby with nokogiri.

Regards

Lester