Need help with parsing multiline XML file

Elastic Stack Logstash
1

Hey everyone,
I am new to logstash and am trying to figure out how to get an xml file to load properly and I just can't seem to get it. I'm sure there's plenty of user error here, but I've done a ton of trial and error.

Here's what I got right now.
Test xml file

<?xml version="1.0"?>
   <book id="bk101">
      <author>Gambardella, Matthew</author>
      <title>XML Developer's Guide</title>
      <genre>Computer</genre>
      <price>44.95</price>
      <publish_date>2000-10-01</publish_date>
      <description>An in-depth look at creating applications 
      with XML.</description>
   </book>
   <book id="bk102">
      <author>Ralls, Kim</author>
      <title>Midnight Rain</title>
      <genre>Fantasy</genre>
      <price>5.95</price>
      <publish_date>2000-12-16</publish_date>
      <description>A former architect battles corporate zombies, 
      an evil sorceress, and her own childhood to become queen 
      of the world.</description>
   </book>

And here is my config file

input {  
  file 
  {
    path => "/var/lib/files/books.xml"
    start_position => "beginning"
    type => "book"
    codec => multiline {
     ##pattern => "<book*" 
     pattern => "^<book .*\>"
     negate => "true"
     what => "previous"
    }
  }
}

filter 
{
  xml {
      store_xml => "false"
      source => "book"
      ##target => "parsed"
      xpath => [ 
        "/book/author", "Author",
        "/book/title", "Title"
      ]
  }
}

output {
    stdout 
    {
        codec => rubydebug
    }
    
    elasticsearch {
        hosts => "elasticsearch:9200"
    }
}

Any help would be greatly appreciated.

2

What does happen? Is Logstash producing any events at all?

3

I am getting logs currently, but everything is crammed into the message event. This is what one of my logs looks like.

{
"_index": "logstash-2016.11.01",
"_type": "book",
"_id": "AVgh15UmZqE3X8UXKZit",
"_score": 1,
"_source": {
"path": "/var/lib/files/books2.xml",
"@timestamp": "2016-11-01T21:42:05.619Z",
"@version": "1",
"host": "f0cfdd2f4d81",
"message": "<book category="WEB">\r\n <title lang="en">Learning XML\r\n Erik T. Ray\r\n 2003\r\n 39.95\r\n\r\n\r",
"type": "book",
"tags": [
"multiline"
]
}

4

"message": "\r\n Learning XML\r\n Erik T. Ray\r\n 2003\r\n 39.95\r\n\r\n\r",

Is this really what it looks like? No XML tags? Always make sure to format configuration files and log file snippets as preformatted text when posting here. And use the preview pane to make sure what you're posting looks okay.