Managing complex XML with Logstash

Elastic Stack Logstash
1

Hello,

Just to receive your opinions/suggestions.
In case one is facing a XML formatted like this:

<root id="XYZ">
  <users>
    <someone id="john.doe" type="human"/>
      <priorities>
        <priority name="high"/>
      </priorities>
      <cities>
        <city name="London"/>
        <city name="Paris"/>
        <city name="Rome"/>
      </cities> 
    </someone>
    <someone id="hal.9001" type="machine"/>
      <priorities>
        <priority name="low"/>
      </priorities>
      <cities>
        <city name="Jupiter"/>
        <city name="Paris"/>
      </cities> 
    </someone>
  </users>
</root>

I would like to obtain a mapping with several entries in Elasticsearch like this:

"someoneId" => "john.doe"
"rootId" => "XYZ"
"priorityName" => "high"
"cities" => [
  [0] "London"
  [1] "Paris"
  [2] "Rome"
],
"someoneId" => "hal.9001"
"rootId" => "XYZ"
"priorityName" => "low"
"cities" => [
  [0] "Jupiter"
  [1] "Paris"
]

Is this possible? Also, it would be possible then to show in Kibana the count of cities = Paris?
For the moment, using the XML filter in Logstash I've only managed to obtain arrays for each element; for example, I obtain this for the cities:

"cities" => [
  [0] "London"
  [1] "Paris"
  [2] "Rome"
  [3] "Jupiter"
  [4] "Paris"
]
2

I've made some experiments with huge XMLs, and I would like to understand if sending large XML files to Logstash is a sound approach, because I've noticed that, for example, the multiline codec can't process more than 500 lines at once, so I'm forced in some cases to use the multiline filter, which is declared deprecated in the documentation.
Any comment will be appreciated :slight_smile: