How to handle XML file "Last ## unconsumed characters" error

[Badger]

I would expect mutate+gsub to be able to do it. For example, to remove the <?xml version... you could use

    mutate { gsub => [ "message", "^<\?xml[^
]+
", "" ] }

Use literal newlines inside the pattern. So that is start of line, followed by <?xml followed by one or more not-newline followed by newline.