With that XML you could use
xml { source => "message" target => "theXML" force_array => false remove_field => [ "message" ] }
mutate {
add_field => {
"LogID" => "%{[theXML][TransferLogDetailForExport][LogID]}"
"LogDateTime" => "%{[theXML][TransferLogDetailForExport][LogDateTime]}"
}
}
split { field => "[theXML][Vouchers]" }
ruby {
code => '
event.get("[theXML][Vouchers]").each { |k, v| event.set(k, v) }
event.remove("[theXML]")
'
}
to produce
{
"VoucherID" => "2",
"LogDateTime" => "2020-01-07T17:00:47",
"@timestamp" => 2020-01-20T21:39:34.862Z,
"VoucherTypeID" => "24",
"Used" => "1",
"ComputerID" => "0",
"LogID" => "15237"
}
{
"VoucherID" => "3",
"LogDateTime" => "2020-01-07T17:00:47",
"@timestamp" => 2020-01-20T21:39:34.862Z,
"VoucherTypeID" => "24",
"Used" => "1",
"ComputerID" => "0",
"LogID" => "15237"
}
etc.