One of our production machines outputs the log into an xml file. Said xml can have 3 different structures:
<useraction> ... <error> ... </error> ... </useraction>
<useraction> ... </useraction>
<error> ... </error>
I'm wondering how my input and filter should look like to make sure that all three types are properly parsed as an event. Is this possible, or do i have to create three different inputs?