title: Logstash split xml into array
body: <p>Is it possible to convert xml into array of objects using logstash?</p>
  
  <p>That'd be my sample document:</p>
  
  <pre><code>{
    "Title" : "My blog title",
    "Body" : "My first post ever",
    "Metadata" : "&lt;root&gt;&lt;Tags&gt;&lt;TagTypeID&gt;1&lt;/TagTypeID&gt;&lt;TagValue&gt;twitter&lt;/TagValue&gt;&lt;/Tags&gt;&lt;Tags&gt;&lt;TagTypeID&gt;1&lt;/TagTypeID&gt;&lt;TagValue&gt;facebook&lt;/TagValue&gt;&lt;/Tags&gt;&lt;Tags&gt;&lt;TagTypeID&gt;2&lt;/TagTypeID&gt;&lt;TagValue&gt;usa&lt;/TagValue&gt;&lt;/Tags&gt;&lt;Tags&gt;&lt;TagTypeID&gt;3&lt;/TagTypeID&gt;&lt;TagValue&gt;smartphones&lt;/TagValue&gt;&lt;/Tags&gt;&lt;/root&gt;"
  }
  </code></pre>
  
  <p>Ideally, I'd like to output this:</p>
  
  <pre><code>{
    "Title" : "My blog title",
    "Body" : "My first post ever",
    "Metadata" : [
      {
        "TagTypeID" : "1",
        "TagValue" : "twitter"
      },
      {
        "TagTypeID" : "1",
        "TagValue" : "facebook"
      },
      {
        "TagTypeID" : "2",
        "TagValue" : "usa"
      },
      {
        "TagTypeID" : "3",
        "TagValue" : "smartphones"
      }
    ]
  }
  </code></pre>
  
  <p>However I'm not able to achieve that. I tried using xml filter like that:</p>
  
  <pre><code>xml
  {
      source =&gt; "Metadata"
      target =&gt; "Parsed"
  }
  </code></pre>
  
  <p>However, it outputs this</p>
  
  <pre><code>{
    "Title" : "My blog title",
    "Body" : "My first post ever",
    "@version" : "1",
    "@timestamp" : "2015-10-27T17:21:31.961Z",
    "Parsed" : {
      "Tags" : [
        {
          "TagTypeID" : ["1"],
          "TagValue" : ["twitter"]
        },
        {
          "TagTypeID" : ["1"],
          "TagValue" : ["facebook"]
        },
        {
          "TagTypeID" : ["2"],
          "TagValue" : ["usa"]
        },
        {
          "TagTypeID" : ["3"],
          "TagValue" : ["smartphones"]
        }
      ]
    }
  }
  </code></pre>
  
  <p>I don't want my values to be stored as arrays (I know there's always going to be just one value there).</p>
  
  <p>I know what fields are going to be brought back from my input, so I can map structure myself and this doesn't need to be dynamic (although that would be nice).</p>
  
  <p><a href="https://github.com/elastic/logstash/issues/2131" rel="nofollow noreferrer">Allow splitting of lists / arrays into multiple events</a> seemed to be useful, but it's poorly documented and I couldn't find information how to use this filter for my use-case.</p>
  
  <p><a href="https://stackoverflow.com/questions/26362303/logstash-split-event-from-an-xml-file-in-multiples-documents-keeping-informatio">Logstash, split event from an xml file in multiples documents keeping information from root tags</a> is similar, but not exactly what I'd like to achieve.</p>
  
  <p><a href="https://stackoverflow.com/questions/31880172/logstash-xml-to-json-output-from-array-to-string">Logstash: XML to JSON output from array to string</a> this seems to be useful, however it hardcodes that first element of array must be outputed as single item (not part of array). It brings me back this:</p>
  
  <pre><code>{
    "Title" : "My blog title",
    "Body" : "My first post ever",
    "@version" : "1",
    "@timestamp" : "2015-10-27T17:21:31.961Z",
    "Parsed" : {
      "Tags" : [
        {
          "TagTypeID" : "1",
          "TagValue" : "twitter"
        },
        {
          "TagTypeID" : ["1"],
          "TagValue" : ["facebook"]
        },
        {
          "TagTypeID" : ["2"],
          "TagValue" : ["usa"]
        },
        {
          "TagTypeID" : ["3"],
          "TagValue" : ["smartphones"]
        }
      ]
    }
  }
  </code></pre>
  
  <ol>
  <li>Can this be done without having to create custom filters? (I've no
  experience in Ruby)</li>
  <li>Or am I missing something basic here?</li>
  </ol>