input {
file {
path => "/tmp/test/test.xml"
start_position => "beginning"
sincedb_path => "NUL"
codec => multiline {
pattern => " <note>|</note>"
negate => true
what => "previous"
auto_flush_interval => 1
}
}
}
filter {
if [message] == "<note>" or [message] == "</note>" {
#here I want to copy at their places
target => "message.parsed"
}
xml {
source => "message"
target => "message.parsed"
xpath => [ "/event/message/text()", eventmessage ]
force_array => false
}
}
output {
file {
path => "/tmp/test/result.xml" }
}
it's all that I could do.. I can't find a way to do that transformation.