# Ruby Iteration in Logstash help

**URL:** <https://discuss.elastic.co/t/ruby-iteration-in-logstash-help/224054>\
**Category:** Logstash\
**Created:** [March 18, 2020, 9:05am UTC](https://discuss.elastic.co/t/ruby-iteration-in-logstash-help/224054 "2020-03-18T09:05:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![GreinerA](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@GreinerA](https://discuss.elastic.co/u/GreinerA)\
**Post date:** [March 18, 2020, 9:05am UTC](https://discuss.elastic.co/t/ruby-iteration-in-logstash-help/224054/1 "2020-03-18T09:05:32Z")

</div>

i have a parsed xml data that looks like this:

```
"ObjLdn_Value" => [
    [0] "PoolType=necc, PoolId=0, PoolMember=0, Machine=XXXXXX1, UUID=ABCDABCD1",
    [1] "PoolType=necc, PoolId=0, PoolMember=1, Machine=XXXXXX2, UUID=ABCDABCD2",
    [2] "PoolType=necc, PoolId=0, PoolMember=2, Machine=XXXXXX3, UUID=ABCDABCD3"
],
     "endTime" => [
    [0] "2020-03-02T10:15:00+01:00"
],
   "TypeValue" => [
    [0] "0",
    [1] "100.00",
    [2] "26777.00",
    [3] "361.00",
    [4] "0",
    [5] "100.00",
    [6] "20214.00",
    [7] "312.00",
    [8] "0",
    [9] "100.00",
    [10] "18203.00",
    [11] "15213.00"
],
        "Type" => [
    [0] "VS.ScdrsTranferredOverBp",
    [1] "VS.swapMemUsage",
    [2] "VS.MemUsedSize",
    [3] "VS.MemAvailableSize"
],

```

the amount of entries in Type, TypeValue and ObjLdn\_Value is different each event.

i want to Create an Output that Loks like this:

"ObjLdn\_Value[0]" has 4 KeyValue Pairs "Type[0,1,2,3]" with the Values "TypeValue[0,1,2,3]"

"ObjLdn\_Value[1]" has 4 KeyValue Pairs "Type[0,1,2,3]" with the Values "TypeValue[4,5,6,7]"  
and  
"ObjLdn\_Value[2]" has 4 KeyValue Pairs "Type[0,1,2,3]" with the Values "TypeValue[8,9,10,11]"

but i am uterly lost. i assume i need to use some ruby code for that?

Any help would be appriciated.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 18, 2020, 3:50pm UTC](https://discuss.elastic.co/t/ruby-iteration-in-logstash-help/224054/2 "2020-03-18T15:50:15Z")

</div>

> [@GreinerA](#):
>
> i want to Create an Output that Loks like this

Is that in any way related to the input?

---

<div class="post-metadata">

**Author:** ![GreinerA](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@GreinerA](https://discuss.elastic.co/u/GreinerA)\
**Post date:** [March 19, 2020, 6:13am UTC](https://discuss.elastic.co/t/ruby-iteration-in-logstash-help/224054/3 "2020-03-19T06:13:02Z")

</div>

yes it is. one ObjLdn\_Value has all Types, and each Type has one TypeValue.

here is what the original xml looked like.

```
<measInfo>
		<granPeriod duration="PT900S" endTime="2020-03-02T10:15:00+01:00" />
		<measType p="1">VS.ScdrsTranferredOverBp</measType>
		<measType p="2">VS.swapMemUsage</measType>
		<measType p="3">VS.MemUsedSize</measType>
		<measType p="4">VS.MemAvailableSize</measType>
		<measValue measObjLdn="PoolType=necc, PoolId=0, PoolMember=0, Machine=XXXXXX1, UUID=ABCDABCD1">
			<r p="1">0</r>
			<r p="2">100.00</r>
			<r p="3">26777.00</r>
			<r p="4">361.00</r>
		</measValue>
		<measValue measObjLdn="PoolType=necc, PoolId=0, PoolMember=1, Machine=XXXXXX2, UUID=ABCDABCD2">
			<r p="1">0</r>
			<r p="2">100.00</r>
			<r p="3">20214.00</r>
			<r p="4">312.00</r>
		</measValue>
		<measValue measObjLdn="PoolType=necc, PoolId=0, PoolMember=2, Machine=XXXXXX3, UUID=ABCDABCD3">
			<r p="1">0</r>
			<r p="2">100.00</r>
			<r p="3">18203.00</r>
			<r p="4">15213.00</r>
		</measValue>
	</measInfo>
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 22, 2020, 6:56pm UTC](https://discuss.elastic.co/t/ruby-iteration-in-logstash-help/224054/4 "2020-03-22T18:56:19Z")

</div>

OK, I am unclear on what output format you want. Also, if the arrays are all ordered lists then we can make assumptions and ignore the value of p. The following code does no error checking, makes assumptions about your data format, and I apologize if my ruby coding style makes anyone's eyeballs bleed, but it should give you an idea of what your code would need to do...

```
    xml { source => "message" target => "[@metadata][theXML]" force_array => false }
    ruby {
        code => '
            xml = event.get("[@metadata][theXML]")
            types = xml["measType"]
            values = xml["measValue"]
            a = []
            values.each { |x|
                h = {}
                h["measObjLdn"] = x["measObjLdn"]
                x["r"].each_index { |i|
                    h[types[i]["content"]] = x["r"][i]["content"]
                }
                a << h
            }
            event.set("data", a)
        '
    }

```

will produce

```
      "data" => [
    [0] {
                  "VS.MemUsedSize" => "26777.00",
             "VS.MemAvailableSize" => "361.00",
                      "measObjLdn" => "PoolType=necc, PoolId=0, PoolMember=0, Machine=XXXXXX1, UUID=ABCDABCD1",
        "VS.ScdrsTranferredOverBp" => "0",
                 "VS.swapMemUsage" => "100.00"
    },
    [1] {
                  "VS.MemUsedSize" => "20214.00",
             "VS.MemAvailableSize" => "312.00",
                      "measObjLdn" => "PoolType=necc, PoolId=0, PoolMember=1, Machine=XXXXXX2, UUID=ABCDABCD2",
        "VS.ScdrsTranferredOverBp" => "0",
                 "VS.swapMemUsage" => "100.00"
    },
    [2] {
                  "VS.MemUsedSize" => "18203.00",
             "VS.MemAvailableSize" => "15213.00",
                      "measObjLdn" => "PoolType=necc, PoolId=0, PoolMember=2, Machine=XXXXXX3, UUID=ABCDABCD3",
        "VS.ScdrsTranferredOverBp" => "0",
                 "VS.swapMemUsage" => "100.00"
    }
],
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2020, 6:56pm UTC](https://discuss.elastic.co/t/ruby-iteration-in-logstash-help/224054/5 "2020-04-19T18:56:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.