Xml filtering subfields

Elastic Stack Logstash
2

I don't think it makes sense to use two xml filters on the same xml. I would save the parsed xml and work on that.

filter {
    xml {
        source => "message"
        target => "[@metadata][theXML]"
        store_xml => true
        remove_namespaces => true
        force_array => false
        remove_field => ["message"]
    }

    split {
        field => "[@metadata][theXML][Event]"
    }

    ruby {
        code => '
            e = event.get("[@metadata][theXML][Event][EventData][Data]")
            if e
                e.each { |x|
                    event.set(x["Name"], x["content"])
                }
            end
        '
    }
    mutate { copy => { "[@metadata][theXML][Event][Computer]" => "Computer" } }
}

You can use a rubydebug output to inspect the parsed XML.

output { stdout { codec => rubydebug { metadata => true } } }