# Logstash XML parsing issues - trying to send to Graylog, part 2

**URL:** https://discuss.elastic.co/t/logstash-xml-parsing-issues-trying-to-send-to-graylog-part-2/193209
**Category:** Logstash
**Created:** [July 31, 2019, 7:26pm UTC](https://discuss.elastic.co/t/logstash-xml-parsing-issues-trying-to-send-to-graylog-part-2/193209 "2019-07-31T19:26:31Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 31, 2019, 7:55pm UTC](https://discuss.elastic.co/t/logstash-xml-parsing-issues-trying-to-send-to-graylog-part-2/193209/2 "2019-07-31T19:55:25Z")

</div>

It seems wasteful to parse the xml twice. I certainly would not store it twice. If you look at the parsed event data you basically have an array of objects that contain [Name] and [content] fields.

```
    "EventData" => {
        "Data" => [
            [0] {
                "IPVersion" => "4",
                     "Name" => "SubjectIP",
                  "content" => " ********"
            },
            [1] {
                "Local" => "false",
                 "Name" => "SubjectUnix",
                  "Uid" => "65534",
                  "Gid" => "65534"
            },
            [2] {
                   "Name" => "SubjectUserSid",
                "content" => " ********"
            },
            [3] {
                   "Name" => "SubjectUserIsLocal",
                "content" => "false"
            },

```

You could use a ruby filter similar to [this](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481/12) to flatten that into a hash.

---

_[View the full topic](https://discuss.elastic.co/t/logstash-xml-parsing-issues-trying-to-send-to-graylog-part-2/193209)._