# Ruby loop

**URL:** https://discuss.elastic.co/t/ruby-loop/72484
**Category:** Logstash
**Created:** [January 23, 2017, 1:48pm UTC](https://discuss.elastic.co/t/ruby-loop/72484 "2017-01-23T13:48:47Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Abhamid](https://avatars.discourse-cdn.com/v4/letter/a/f0a364/32.png) [@Abhamid](https://discuss.elastic.co/u/Abhamid)
#### Post date: [January 23, 2017, 1:48pm UTC](https://discuss.elastic.co/t/ruby-loop/72484/1 "2017-01-23T13:48:47Z")

</div>

Dear,  
I am a new one in ELK suite, i want use logstash, to update some fields in xml file before insert them in elastcis.  
My problem is that the xml file, has a nested fields, and from file tof ile, the numebr of netsed field is not same.

```
 **here after an xml file**

 <?xml version="1.0"?>
      -<test1 xmlns="test1s.model.toto.com">
               <Version>V01.13</Version>
               <T_ID>370501</T_ID>
               <Stt>5</Stt>
               <S_ID2>3705</S_ID2>
               <Date>2016-12-13T10:04:54.697Z</Date>
               -<Opes>
                      -<Ope Type="1">
                              <Start>2016-12-13T10:04:55.570Z</Start>
                             <End>2016-12-13T10:04:56.120Z</End>
                             <S_ID2>3705</S_ID2>
                             <Vrdt Value="2">2</Vrdt>
                      </Ope>
                     -<Ope Type="3">
                             <Start>2016-12-13T10:05:36.883Z</Start>
                             <End>2016-12-13T10:05:44.287Z</End>
                             <Log_tst>scv</Log_tst>
                             <Wk_test>toto_tst</Wk_test>
                             <S_ID2>3705</S_ID2>
                             <Vrdt Value="0">0</Vrdt>
                       </Ope>
                </Opes>
                <UpdateDateTime>2016-12-13T10:05:45.030Z</UpdateDateTime>
                <LastStateDateTime>2016-12-13T10:05:45.027Z</LastStateDateTime>
    </test1>

```

**here a logstash pipeline file**

input {  
file {  
path =\> "/usr/share/img\_pro/\*\*/\*.xml"  
type =\> "data\_xml"  
codec =\> plain {  
charset =\> "ISO-8859-1"  
}  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}  
filter {  
if [type] == "data\_xml" {

```
      xml {
            source => "message"
            store_xml => true
            target => "parsed_xml"
		}
   }

```

ruby {  
code =\> "  
event['[parsed\_xml][Opes[0]][Ope]'].each {|Op| event ['[Op][Vrdt[0]][Value]'] = "Val1" }  
"  
}  
}

mutate {  
remove\_field =\> ["message", "host", "port", "tags", "@version", "@timestamp"]  
}

}  
output {  
if "\_xmlparsefailure" not in [tags]  
{  
stdout { codec =\> rubydebug }  
}else {  
file {  
path =\> "/usr/share/bad\_xml/xml-bad.tsv"  
}  
}  
}

What i want is to update field " Vrdt" to "test\_0" if it's value is 0, to to "test\_1" if it's value is 1, ... for exemple.

Thank you for your help

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 20, 2017, 1:49pm UTC](https://discuss.elastic.co/t/ruby-loop/72484/2 "2017-02-20T13:49:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.