# XML some similare tags generate row for each

**URL:** <https://discuss.elastic.co/t/xml-some-similare-tags-generate-row-for-each/369339>\
**Category:** Logstash\
**Created:** [October 24, 2024, 9:18am UTC](https://discuss.elastic.co/t/xml-some-similare-tags-generate-row-for-each/369339 "2024-10-24T09:18:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Spiralium](https://avatars.discourse-cdn.com/v4/letter/s/b9e5f3/32.png) [@Spiralium](https://discuss.elastic.co/u/Spiralium)\
**Post date:** [October 24, 2024, 9:18am UTC](https://discuss.elastic.co/t/xml-some-similare-tags-generate-row-for-each/369339/1 "2024-10-24T09:18:54Z")

</div>

Hello,

I try to extract datas from a XML like :

```auto
<?xml version="1.0" encoding="ISO-8859-1" standalone="yes"?>
<MASTER>
<CODE>ABC</CODE>
<ENTITE>FR</ENTITE>
<TYPEDEMANDE>prevision</TYPEDEMANDE>
<critere>
    <numero>field1</numero>
    <valeur>one</valeur>
  </critere>
  <critere>
    <numero>field2</numero>
    <valeur>two</valeur>
  </critere>
  <critere>
    <numero>field3</numero>
    <valeur>three</valeur>
  </critere>
  <critere>
    <numero>field4</numero>
    <valeur>four</valeur>
  </critere>
  <critere>
    <numero>field5</numero>
    <valeur>five</valeur>
  </critere>
</MASTER>

```

I use the XML filter and it works fine for the firsts three tag.  
But I would create new field for each with as field name and as value for the field.

I try to use XPATH but it put all in only one field.

Actual xml filter :

```auto
xml {
          source => "request_service"
          store_xml => false
          xpath => ["//critere/*","datas"]
          add_field => { "%{numero}" => "%{valeur}"}
        }

```

Have you any idea to help me ?

Thanks in advance and have a nice day

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 24, 2024, 12:05pm UTC](https://discuss.elastic.co/t/xml-some-similare-tags-generate-row-for-each/369339/2 "2024-10-24T12:05:14Z")

</div>

You could try

```
    xml { source => "message" target => "[@metadata][theXML]" force_array => false }

    ruby {
        code => '
            event.get("[@metadata][theXML][critere]")&.each { |h|
                event.set(h["numero"], h["valeur"])
            }
        '
    }

```

---

<div class="post-metadata">

**Author:** ![Spiralium](https://avatars.discourse-cdn.com/v4/letter/s/b9e5f3/32.png) [@Spiralium](https://discuss.elastic.co/u/Spiralium)\
**Post date:** [October 24, 2024, 1:49pm UTC](https://discuss.elastic.co/t/xml-some-similare-tags-generate-row-for-each/369339/3 "2024-10-24T13:49:19Z")

</div>

Hello,

I have an error but it's because the "numero" could contain "[0]".

I try to use gsub inside the ruby code to substitute `[0]` by `_0_` but I don't know where to put it.

I found the regex to use : `\[\d\]` and probably `_\1_` for the remplacement.

I never code with Ruby.

Coudl you help me ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 24, 2024, 2:49pm UTC](https://discuss.elastic.co/t/xml-some-similare-tags-generate-row-for-each/369339/5 "2024-10-24T14:49:04Z")

</div>

> [@Spiralium](#):
>
> I have an error but it's because the "numero" could contain "[0]".

If you are getting "Ruby exception occurred: Invalid FieldReference" because numero looks like "word[0]" then you can fix that by changing the event.set call

```
event.set(h["numero"].gsub(/[\[\]]/, "_"), h["valeur"])

```

---

<div class="post-metadata">

**Author:** ![Spiralium](https://avatars.discourse-cdn.com/v4/letter/s/b9e5f3/32.png) [@Spiralium](https://discuss.elastic.co/u/Spiralium)\
**Post date:** [October 24, 2024, 3:19pm UTC](https://discuss.elastic.co/t/xml-some-similare-tags-generate-row-for-each/369339/6 "2024-10-24T15:19:04Z")

</div>

Hi Badger

It seems to work fine for the critere part. I just continue to make some tests.  
But now, I don't have the firsts tags before the critere.  
I think I have to work with `[@metadata][theXML]` to get the missing tags.

Can you explain me the synthax : `target => "[@metadata][theXML]`

Hum hum sorry I just have to read the documentation.  
[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)

Thanks in advance and for your precious help.