Logstash - XML Filter not working properly

With that XML in a generator input and that filter, I get 4 messages. It might be time to take a closer look at how your multiline pattern is performing.

Getting the first line of XML (the <?xml...) as a separate line, which of course will not parse, is expected. You will also be missing the last entry in the file, since there is no line matching " <CxXMLResults" to flush the last event.

Using auto_flush_interval on the file input might help.

If you just want to consume the entire file in a single event (which you can then split) I normally use a pattern that never matches.

codec => multiline { pattern => "^Spalanzani" what => "previous" negate => true auto_flush_interval => 1 } } }