Split XML

From what I can tell split doesn't easily support xml.

If you have multiple values in the same message, which is what I think you're saying, then you could try parsing the xml then running the split over the results - as suggested in this post.

Just note that you can't run the xml filter on invalid xml, so you would have to wrap the row items in a containing tag before putting it through the xml plugin.

e.g.

add_field => {"newfield" => "<something>%{message}</something>"}