It seems wasteful to parse the xml twice. I certainly would not store it twice. If you look at the parsed event data you basically have an array of objects that contain [Name] and [content] fields.
"EventData" => {
"Data" => [
[ 0] {
"IPVersion" => "4",
"Name" => "SubjectIP",
"content" => "********"
},
[ 1] {
"Local" => "false",
"Name" => "SubjectUnix",
"Uid" => "65534",
"Gid" => "65534"
},
[ 2] {
"Name" => "SubjectUserSid",
"content" => "********"
},
[ 3] {
"Name" => "SubjectUserIsLocal",
"content" => "false"
},
You could use a ruby filter similar to this to flatten that into a hash.