How to remove first line of a multiline message

Elastic Stack Logstash
1

hi,
i am parsing a multiline log containg lots of garbage and in between pearls of xml data that I'd like to extract.

my data looks like this:

some Text I'd like to drop {}
some Text with a token signaling XML Document starting in next line

<?xml.... <a> <b/> </a> some Text I'd like to drop {} some Text with a token signaling XML Document starting in next line <c> <b/> </c> some Text I'd like to drop {}

Problem is not all xml's start with proper processing instructions so I have to rely on the token in the preceeding line as a hook for starting a new multiline message. I got as far as getting a multiline pattern setup giving me the XML + the preceeding line containg my token signaling the xml start.

So my message looks like this:

some Text with a token signaling XML Document starting in next line\r\n

<?xml ....\r\n <a>\r\n <b/>\r\n </a>\r\n

I'd like to remove the first line of the resulting message in order to get a valid xml. Any ideas on how to get that done?
Thanks for your ideas/feedback,
Markus

2

The mutate filter's gsub option should be useful for this.