If you are using store_xml => true then the xml filter does not care about random text prefixing the XML. However, the xpath option most certainly does. Try
mutate { gsub => [ "message", "^[^<]+<", "<" ] }
xml {
source => "message"
store_xml => false
force_array => false
remove_namespaces => true
xpath => {
"/FileTransferOperationRequest/fromUrl/text()" => "fromurl"
"/FileTransferOperationRequest/toUrl/text()" => "tourl"
"/FileTransferOperationRequest/filename/text()" => "filename"
}
}
which gets me
"fromurl" => "/talendprojects/fileServices/workingFolder",
"tourl" => "/mnt/gis/Input/NEMs/AvailabilityHuawei",
"filename" => "pmresult_1526726662_15_201908271215_201908271230_201908271247.csv.gz",