Parsing xml using logstaash xpath

Append some pattern that you are confident will not occur in the XML (easy in this case) then use a stdin input with a multiline codec. That should capture the XML as a single event, which you can start attacking with an xml filter.

(cat file.xml; echo "Monsieur Spalanzani n'aime pas la musique") | ./logstash -f ...
input{
  stdin {
    codec => multiline {
      pattern => "^Monsieur Spalanzani n'aime pas la musique"
      negate => "true"
      what => "previous"
    }
  }
}
1 Like