# Xml filter on nested element **URL:** \ **Category:** Logstash\ **Created:** [March 8, 2021, 11:50pm UTC](https://discuss.elastic.co/t/xml-filter-on-nested-element/266619 "2021-03-08T23:50:11Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 9, 2021, 2:13am UTC](https://discuss.elastic.co/t/xml-filter-on-nested-element/266619/2 "2021-03-09T02:13:04Z")
You could write a ruby filter that iterates over the [record][history] field and parses the [fieldC] string on each entry. If you read the [source](https://github.com/logstash-plugins/logstash-filter-xml/blob/master/lib/logstash/filters/xml.rb) for the xml filter then you will see that the `store_xml => true` code path is actually pretty simple, especially since you can remove most of the option handling and just hard-code the options you want. Alternatively, you can use a split filter to create multiple events, each of which has a [record][history][fieldC] string, then use an xml filter configured any way you want, including xpath. You might want to use xpath to extract elements or attributes of interest and save them in [@metadata][fieldC][someElement], then use mutate+copy (not mutate+rename) to copy [@metadata][fieldC] to [record][history][fieldC]. If you really want the replacement field to be [record][history][fieldCReplacement] (i.e. a different name) there is no need to do this and you can use xpath to do the extraction directly. Once the [record][history] fields look the way you want then you can recombine them using an aggregate filter. [This](https://discuss.elastic.co/t/a-json-array-consists-of-objects-how-to-deal-with/264464/2) post has an example of how to do that. --- _[View the full topic](https://discuss.elastic.co/t/xml-filter-on-nested-element/266619)._