title: How to delete lines in xml using logstash
body: <p>everybody.
  I am new to logstash. I've been studying filters in logstash for a week, but no result.
  I want to parse xml. I have the following xml:</p>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot; standalone=&quot;no&quot;?&gt;
  &lt;ContinentLogs&gt;
      &lt;Cryptogateways&gt;
          &lt;cgw id=&quot;1&quot; cssid=&quot;0&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ -3:00 RCPTZS -4:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;ЦУС&lt;/cgw&gt;
          &lt;cgw id=&quot;2&quot; cssid=&quot;50556&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ -3:00 RCPTZS -4:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;DP.152FZ.DA01&lt;/cgw&gt;
          &lt;cgw id=&quot;3&quot; cssid=&quot;50557&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ -3:00 RCPTZS -4:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;M1.152FZ.DA01&lt;/cgw&gt;
          &lt;cgw id=&quot;4&quot; cssid=&quot;51358&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ 00:00 RCPTZS 00:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;3D Get&lt;/cgw&gt;
          &lt;cgw id=&quot;5&quot; cssid=&quot;51491&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ -3:00 RCPTZS -4:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;М1.152FZ.CUS02&lt;/cgw&gt;
          &lt;cgw id=&quot;6&quot; cssid=&quot;51845&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ -3:00 RCPTZS -4:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;DP.152FZ.FW01&lt;/cgw&gt;
          &lt;cgw id=&quot;7&quot; cssid=&quot;51847&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ -3:00 RCPTZS -4:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;M1.152FZ.FW01&lt;/cgw&gt;
          &lt;cgw id=&quot;8&quot; cssid=&quot;53840&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ -3:00 RCPTZS -4:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;M1.152FZ.FW02&lt;/cgw&gt;
          &lt;cgw id=&quot;9&quot; cssid=&quot;68604&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ -3:00 RCPTZS -4:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;TNC MIG&lt;/cgw&gt;
          &lt;cgw id=&quot;10&quot; cssid=&quot;69007&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ -3:00 RCPTZS -4:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;HAKR&lt;/cgw&gt;
          &lt;cgw id=&quot;11&quot; cssid=&quot;111846&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ -3:00 RCPTZS -4:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;ALT MOT&lt;/cgw&gt;
          &lt;cgw id=&quot;12&quot; cssid=&quot;111978&quot; ip=&quot;0.0.0.0&quot; tz=&quot;RCPTZ -3:00 RCPTZS -4:00,M0.0.0/00:00:00,M0.0.0/00:00:00&quot;&gt;GPB RIM&lt;/cgw&gt;
      &lt;/Cryptogateways&gt;
      &lt;FilterRules&gt;
          &lt;rule id=&quot;-8&quot; deleted=&quot;false&quot;&gt;Pravil&lt;/rule&gt;
          &lt;rule id=&quot;-5&quot; deleted=&quot;false&quot;&gt;(?) Neopredelen&lt;/rule&gt;
          &lt;rule id=&quot;-3&quot; deleted=&quot;false&quot;&gt;Udalenni pravila&lt;/rule&gt;
          &lt;rule id=&quot;-2&quot; deleted=&quot;false&quot;&gt;SD prav&lt;/rule&gt;
          &lt;rule id=&quot;-1&quot; deleted=&quot;false&quot;&gt;Slygeb prav&lt;/rule&gt;
          &lt;rule id=&quot;0&quot; deleted=&quot;false&quot;&gt;Ne sootvetsvyet&lt;/rule&gt;
          &lt;rule id=&quot;17&quot; deleted=&quot;false&quot;&gt;Mon =&amp;gt; Mail Server&lt;/rule&gt;
      &lt;/FilterRules&gt;
  &lt;/ContinentLogs&gt;
  </code></pre>
  <p>I want to remove lines that have «cgw id=&quot;3&quot;» и «cgw id=&quot;7&quot;» in the  section.
  And remove the lines that have «rule id=&quot;-5&quot;» и «rule id=&quot;0&quot;» in the  section.
  Write everything back to xml without changing anything else.
  Help how to do this through Logstash?
  Thank you in advance.</p>