# Run xml filter on fields created in ruby

**URL:** <https://discuss.elastic.co/t/run-xml-filter-on-fields-created-in-ruby/119945>\
**Category:** Logstash\
**Created:** [February 15, 2018, 9:01am UTC](https://discuss.elastic.co/t/run-xml-filter-on-fields-created-in-ruby/119945 "2018-02-15T09:01:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssasporta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ssasporta/32/13695_2.png) [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Post date:** [February 15, 2018, 9:01am UTC](https://discuss.elastic.co/t/run-xml-filter-on-fields-created-in-ruby/119945/1 "2018-02-15T09:01:46Z")

</div>

While handling a huge log,  
I am running ruby code filer and according to some rules, I am creating new fields to the event: **Object1, Object2, etc..**.. .  
The Number of Objects is according to the input in the event, but during scanning the event I also counting them.

In the end of the ruby filter, I have a parameter holding the number of **Object field** s and the **Objects fields themselves**.

**For example:**  
I can have a field: `objectsCounter` with the **value 4** and I will have `Object1 .. Object4` fields too.

On each of the Object1 .. Object4 fields, I need to run xml filter.

How can I do it in loop? Or run the xml filter via Ruby?

Regards,  
Sharon.

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [February 16, 2018, 9:32am UTC](https://discuss.elastic.co/t/run-xml-filter-on-fields-created-in-ruby/119945/2 "2018-02-16T09:32:14Z")

</div>

Can you post an example of what your data looks like after ruby has processed it?

---

<div class="post-metadata">

**Author:** ![ssasporta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ssasporta/32/13695_2.png) [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Post date:** [February 16, 2018, 9:52pm UTC](https://discuss.elastic.co/t/run-xml-filter-on-fields-created-in-ruby/119945/3 "2018-02-16T21:52:59Z")

</div>

I don't think it is relevant how my xml objects look like.

What is relevant is the problem how to loop on known number of ObjectX (Object1 ... ObjectsN) and run the xml filter on them one by one.

I think that solution is to run the XML filter in the ruby, during these Obects are created.

For that I installed **nokogiri ruby gem** and in my conf file I wrote:

**event.set("Object"+(objindex-1).to\_s, Nokogiri::XML.parse((function\_array[objindex].to\_s).split("**_\n").last.strip))_\*

It still not working.

How do I connect it to Logstash? Do I need to do something special?

Thanks  
Sharon.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2018, 9:53pm UTC](https://discuss.elastic.co/t/run-xml-filter-on-fields-created-in-ruby/119945/4 "2018-03-16T21:53:05Z")

</div>

Closed on March 16, 2018, 9:53pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.