Logstash XML parsing issues - trying to send to Graylog, part 2

Elastic Stack Logstash
2

It seems wasteful to parse the xml twice. I certainly would not store it twice. If you look at the parsed event data you basically have an array of objects that contain [Name] and [content] fields.

    "EventData" => {
        "Data" => [
            [ 0] {
                "IPVersion" => "4",
                     "Name" => "SubjectIP",
                  "content" => "********"
            },
            [ 1] {
                "Local" => "false",
                 "Name" => "SubjectUnix",
                  "Uid" => "65534",
                  "Gid" => "65534"
            },
            [ 2] {
                   "Name" => "SubjectUserSid",
                "content" => "********"
            },
            [ 3] {
                   "Name" => "SubjectUserIsLocal",
                "content" => "false"
            },

You could use a ruby filter similar to this to flatten that into a hash.