Append metadata to every event in XML file being ingested to Elasticsearch

Elastic Stack Logstash
2

I assume your xml file will have </events> and </eventdata>. If not it is not valid XML, but that can be fixed with a mutate+ gsub to append text to the message if needed.

Consume the entire XML as a single event using a file input and a multiline codec that never matches. For example

codec => multiline { pattern => "^Spalanzani" negate => true what => "previous" auto_flush_interval => 1 }

Then you can parse the XML and split on the event field

xml { source => "message" target => "theXML" store_xml => true }
split { field => "[theXML][events][0][event]" }

Then you just have mutate+rename all the fields to get them where you want them.