# Is it possible to change output structure

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759>\
**Category:** Logstash\
**Created:** [October 24, 2018, 9:16am UTC](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759 "2018-10-24T09:16:52Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![humalog](https://avatars.discourse-cdn.com/v4/letter/h/cc9497/32.png) [@humalog](https://discuss.elastic.co/u/humalog)\
**Post date:** [October 25, 2018, 11:19am UTC](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759/21 "2018-10-25T11:19:56Z")

</div>

I didn't expect this will work, but it does.  
I search smth what works when I don't know how many bid elements I have in my logfile.

---

<div class="post-metadata">

**Author:** ![balumurari1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balumurari1/32/39203_2.png) [@balumurari1](https://discuss.elastic.co/u/balumurari1)\
**Post date:** [October 25, 2018, 11:23am UTC](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759/22 "2018-10-25T11:23:39Z")

</div>

Yup, probably your xml file is not in unique format.  
The format is different with the bid elements, then we need to change the code,

if your xml file is in unique format there will not be any problem.

---

<div class="post-metadata">

**Author:** ![humalog](https://avatars.discourse-cdn.com/v4/letter/h/cc9497/32.png) [@humalog](https://discuss.elastic.co/u/humalog)\
**Post date:** [October 25, 2018, 11:26am UTC](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759/23 "2018-10-25T11:26:41Z")

</div>

Ah no, it's not unique. I try to build a script which will work above XML files which can be different a bit different to each other. But the differences aren't that big. At the moment I try to learn ruby a bit so I work with one file and try to applay it to others.

---

<div class="post-metadata">

**Author:** ![humalog](https://avatars.discourse-cdn.com/v4/letter/h/cc9497/32.png) [@humalog](https://discuss.elastic.co/u/humalog)\
**Post date:** [October 25, 2018, 11:46am UTC](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759/24 "2018-10-25T11:46:17Z")

</div>

My xml files looks like my sample but with multiple elements. The values can be different in every field.

```auto
<?xml version="1.0" ?>
<system>
<Report name="Scan">
<ReportHost ip="11.111.11.1"><HostProperties>
<tag pluginname="LastUnauthenticatedResults">1539<tag>
<tag pluginnname="Scan">false</tag>
</HostProperties>
<ReportItem port="0" severity="0">
</ReportItem>
<ReportItem port="22" severity="3">
</ReportItem>
<ReportItem port="80" severity="5">
</ReportItem>
</ReportHost>
<ReportHost ip="128.98.11.9"><HostProperties>
<tag pluginname="os">linux<tag>
<tag pluginname="cpe">linux_kernel</tag>
</HostProperties>
<ReportItem port="17" severity="3">
</ReportItem>
<ReportItem port="22" severity="3">
<bid>1111</bid>
<bid>2222</bid>
</ReportItem>
<ReportItem port="80" severity="7">
<bid>1787</bid>
<cve>CVE-2008-5161</cve>
<cve>CVE-2007-6713</cve>
<solution>n/a</solution>
</ReportItem>
</ReportHost>
</Report>
</system>

```

And my files have about 300000 lines where they should work...

---

<div class="post-metadata">

**Author:** ![balumurari1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balumurari1/32/39203_2.png) [@balumurari1](https://discuss.elastic.co/u/balumurari1)\
**Post date:** [October 25, 2018, 11:47am UTC](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759/25 "2018-10-25T11:47:49Z")

</div>

> [@humalog](#):
>
> Ah no, it's not unique. I try to build a script which will work above XML files which can be different a bit different to each other. But the differences aren't that big. At the moment I try to learn ruby a bit so I work with one file and try to applay it to others.

it sounds like a good idea, try it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2018, 11:47am UTC](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759/26 "2018-11-22T11:47:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759.md?page=1)