I would start with something like this:
input {
file {
path => "/somepath/somefile.xml"
codec => multiline {
pattern => "randomString"
negate => true
what => "previous"
auto_flush_interval => 2
}
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
output { stdout { codec => rubydebug } }
filter {
xml {
source => "message"
target => "theXML"
store_xml => true
}
}