# XML plugin + split + ruby code to generate dynamic fields

**URL:** https://discuss.elastic.co/t/xml-plugin-split-ruby-code-to-generate-dynamic-fields/164491
**Category:** Logstash
**Created:** [January 16, 2019, 3:45pm UTC](https://discuss.elastic.co/t/xml-plugin-split-ruby-code-to-generate-dynamic-fields/164491 "2019-01-16T15:45:52Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)
#### Post date: [January 16, 2019, 3:45pm UTC](https://discuss.elastic.co/t/xml-plugin-split-ruby-code-to-generate-dynamic-fields/164491/1 "2019-01-16T15:45:52Z")

</div>

Hi,  
I have a compplex XML with information about phone network cells we need to parse. I managed to ingest the data using the xml and the split filter in order to have the desired information in separate documents into elastic. So far, so god  
Now I have this problem. The documents contains a nested field called poc,mi like this:

```
{
  "mt": [
    "pmLossOfFrame",
    "pmLossOfSignal",
    "pmSfpTxPower",
    "pmSfpRxPower",
    "pmSfpTxBias",
    "pmBitError"
  ],
  "mv": {
    "moid": [
      " 1,1,1,1,1,F"
    ],
    "r": [
      "0",
      "0",
      "0",
      "0",
      "0",
      "0,0,0,0,0,0"
    ]
  }
}

```

I need to extract the mt value and the r values into arrays inside a ruby code.  
I'have tried several ways but no luck

Thank you  
Regards  
Ana

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 16, 2019, 3:57pm UTC](https://discuss.elastic.co/t/xml-plugin-split-ruby-code-to-generate-dynamic-fields/164491/2 "2019-01-16T15:57:04Z")

</div>

What structure do you want to end up with?

---

<div class="post-metadata">

### Author: ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)
#### Post date: [January 16, 2019, 4:26pm UTC](https://discuss.elastic.co/t/xml-plugin-split-ruby-code-to-generate-dynamic-fields/164491/3 "2019-01-16T16:26:44Z")

</div>

Hi @Badger  
I solved using the following code (any suggestion is welcome)

```
  ruby {
            code => "
                     param=event.get('[poc][mi]')[0]['mt']
                     values=event.get('[poc][mi]')[0]['mv']['r']
                     array=[param, values].transpose
                     array.each {|x| event.set(x[0],x[1])}
            "
    }

```

The structure I need to end up with is:  
the values of the mt array as individuals fields whose value is in the r array matching positionally (it is a very ugly XML). See attached.

Any suggestion is welcome  
Regards  
Ana

 ![structure](https://us1.discourse-cdn.com/elastic/original/3X/5/7/57b03bd43e2132678b2aebeb2b3f60b4a9d94328.jpeg)

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 16, 2019, 4:38pm UTC](https://discuss.elastic.co/t/xml-plugin-split-ruby-code-to-generate-dynamic-fields/164491/4 "2019-01-16T16:38:43Z")

</div>

> [@Anabella\_Cristaldi](#):
>
> Any suggestion is welcome

That's the way to do it. Personally I would have written it slightly differently, but it is six of one and half a dozen of the other.

```
param.each_index {|x| event.set(param[x],values[x])}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 13, 2019, 4:38pm UTC](https://discuss.elastic.co/t/xml-plugin-split-ruby-code-to-generate-dynamic-fields/164491/5 "2019-02-13T16:38:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
