How to parse xml from a single line

[motts]

I may be mistaken, but my experience with the "target" options is that data will not go into a field that is not already defined or created. I would try adding the "xml_content" field before designating the data to go there.

@magnusbaeck stated something similar in the article here:

Set target of xml filter to root?

I want the store_xml setting of the xml filter to store child elements of the input XML event as top-level fields. Is this possible? Or should I create an issue in GitHub for this? For example, given this input XML event: <event> <property1>v1</property1> <property2>v2</property2> </event> I want this output: "@timestamp":"...", "property1":"v1", "property2":"v2" not, say: "@timestamp":"...", "xml_content": { "property1":"v1", "property2":"v2" } And to do that, I’d prefer not to …