# Is it possible to change output structure

**URL:** https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759
**Category:** Logstash
**Created:** [October 24, 2018, 9:16am UTC](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759 "2018-10-24T09:16:52Z")
**Posts on this page:** 1
**Showing post:** 6

<div class="post-metadata">

### Author: ![balumurari1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balumurari1/32/39203_2.png) [@balumurari1](https://discuss.elastic.co/u/balumurari1)
#### Post date: [October 24, 2018, 12:38pm UTC](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759/6 "2018-10-24T12:38:31Z")

</div>

The xml file which you have posted has an error, didnot close the tag  
\<tag pluginname="LastUnauthenticatedResults"\>1539\</tag\>

The input code is as follows as per your requirement,

input {  
file {  
path =\> "D:/xxxxx/ELKStack/sample.xml"  
start\_position =\> "beginning"  
sincedb\_path =\> "NUL"  
codec =\> multiline {  
pattern =\> ""  
negate =\> "true"  
what =\> "previous"  
auto\_flush\_interval =\> 1  
max\_lines =\> 333333  
}  
}  
}

filter {  
xml {  
source =\> "message"  
target =\> "parsed"  
store\_xml =\> "false"  
xpath =\> [  
"/system/Report/ReportHost/@ip","ip",  
"/system/Report/ReportHost/HostProperties/tag/@pluginname","pluginname",  
"/system/Report/ReportHost/HostProperties/tag/text()","content",  
"/system/Report/ReportHost/ReportItem/@port","portname",  
"/system/Report/ReportHost/ReportItem/@severity","severity"   
]  
}

ruby {  
code =\> "   
i = event.get('ip')  
n = event.get('pluginname')  
p = event.get('portname')  
s = event.get('severity')  
carr =   
s.each\_index { |k|  
h = { 'portname' =\> p[k] , 'severity' =\> s[k] , 'ip' =\> i[0], 'pluginname' =\> n[0] }  
carr \<\< h  
}  
event.set('reportitem', carr) "  
}  
mutate {  
remove\_field =\> ["message","@version"]  
}

}

output {  
stdout {  
codec =\> rubydebug  
}  
}

the output is as shown in the image below

![Capture](https://us1.discourse-cdn.com/elastic/original/3X/a/2/a28319cf5fa406cd54d726cf9833766411d328ec.png)

---

_[View the full topic](https://discuss.elastic.co/t/is-it-possible-to-change-output-structure/153759)._