# Xml filter on nested element

**URL:** <https://discuss.elastic.co/t/xml-filter-on-nested-element/266619>\
**Category:** Logstash\
**Created:** [March 8, 2021, 11:50pm UTC](https://discuss.elastic.co/t/xml-filter-on-nested-element/266619 "2021-03-08T23:50:11Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![StashLogs](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@StashLogs](https://discuss.elastic.co/u/StashLogs)\
**Post date:** [March 11, 2021, 2:06pm UTC](https://discuss.elastic.co/t/xml-filter-on-nested-element/266619/12 "2021-03-11T14:06:12Z")

</div>

I managed to solve the problem. I tried the split/aggregate solution the whole day, but it did not end up working as expected.  
But, the first option you presented was a success. A ruby filter, inspired by the post you linked and  
[this post](https://discuss.elastic.co/t/logstash-ruby-script-to-create-array-of-nested-fields/200312/2) helped to get the final solution.

```auto
	ruby {
      init => "require 'nokogiri'"
        code => "
              oldHistory ||= event.get('history')
              newHistory ||= []
              field1CReplacement = {}
              oldHistory.each { |x|

                if x.include? 'field1C'
                  value = x['event_history_xmlclassification']
                  doc = Nokogiri::XML::Document.parse(value, nil, value.encoding.to_s)
                  doc.remove_namespaces!
				  
                  attr1 = doc.xpath('/xmlRootTag/@attr1').text
                  field1CReplacement['attr1'] ||= attr1
                  attr2 = doc.xpath('/xmlRootTag/@attr2').text
                  field1CReplacement['attr2'] ||= attr2
                 
				  
                  x['field1CReplacement'] = field1CReplacement
                end
                 newHistory << x
              }
              event.set('history', newHistory)
            "
    }

```

Thanks you for your guidance!

---

_[View the full topic](https://discuss.elastic.co/t/xml-filter-on-nested-element/266619)._