# Logstash: Adding custom field to documennt

**URL:** https://discuss.elastic.co/t/logstash-adding-custom-field-to-documennt/139361
**Category:** Logstash
**Created:** [July 10, 2018, 1:59pm UTC](https://discuss.elastic.co/t/logstash-adding-custom-field-to-documennt/139361 "2018-07-10T13:59:12Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 10, 2018, 3:49pm UTC](https://discuss.elastic.co/t/logstash-adding-custom-field-to-documennt/139361/4 "2018-07-10T15:49:59Z")

</div>

I would use a multiline codec for that

```
input { stdin { codec => multiline { pattern => "</Object>" negate => true what => "next" auto_flush_interval => 3 } } }

```

Then an xml filter

```
filter { xml { source => "message" store_xml => true target => "theXML" force_array => false } }

```

At that point you have a couple of choices. You could flatten the attributes using a ruby filter.

```
    ruby {
        code => '
            event.get("[theXML][Attribute]").each { |v|
                event.set("[Attributes]" + v["name"], v["value"])
            }
        '
    }

```

Or you could iterate over the set and just stash the value you want in a temporary place, then use it to build the id.

```
    ruby {
        code => '
            event.get("[theXML][Attribute]").each { |v|
                if v["name"] == "Last Modified On"
                    event.set("[@metadata][lastModified]" , v["value"])
                end
            }
        '
    }
```

---

_[View the full topic](https://discuss.elastic.co/t/logstash-adding-custom-field-to-documennt/139361)._