# Is it possible to change output structure

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759>\
**Category:** Logstash\
**Created:** [October 24, 2018, 9:16am UTC](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759 "2018-10-24T09:16:52Z")\
**Posts on this page:** 1\
**Showing post:** 17

<div class="post-metadata">

**Author:** ![balumurari1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balumurari1/32/39203_2.png) [@balumurari1](https://discuss.elastic.co/u/balumurari1)\
**Post date:** [October 25, 2018, 10:39am UTC](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759/17 "2018-10-25T10:39:40Z")

</div>

The input code as per your requirement is as follows,

input {  
file {  
path =\> "D:/xxxxx/ELKStack/sample.xml"  
start\_position =\> "beginning"  
sincedb\_path =\> "NUL"  
codec =\> multiline {  
pattern =\> ""  
negate =\> "true"  
what =\> "previous"  
auto\_flush\_interval =\> 1  
max\_lines =\> 333333  
}  
}  
}

filter {  
xml {  
source =\> "message"  
target =\> "parsed"  
store\_xml =\> "false"  
xpath =\> [  
"/system/Report/ReportHost/@ip","ip",  
"/system/Report/ReportHost/HostProperties/tag/@pluginname","pluginname",  
"/system/Report/ReportHost/HostProperties/tag/text()","content",  
"/system/Report/ReportHost/ReportItem/@port","portname",  
"/system/Report/ReportHost/ReportItem/@severity","severity",  
"/system/Report/ReportHost/ReportItem/bid/text()","bidvalue"  
]  
}

ruby {  
code =\> "   
i = event.get('ip')  
n = event.get('pluginname')  
p = event.get('portname')  
s = event.get('severity')  
b = event.get('bidvalue')  
carr =   
s.each\_index { |k|  
h = { 'portname' =\> p[k] , 'severity' =\> s[k] , 'ip' =\> i[0], 'pluginname' =\> n[0],'bid1' =\> b[0],'bid2' =\> b[1] }  
carr \<\< h  
}  
event.set('reportitem', carr) "  
}  
mutate {  
remove\_field =\> ["message","@version"]  
}

}

output {  
stdout {  
codec =\> rubydebug  
}  
}

The output is as shown in below image,

![Capture](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4d2d81e61fd416d19ceb24c5e308d031822feb5c.png)

---

_[View the full topic](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759)._