Unable to index xml file properly using logstash


I am trying to index big xml file.

Below is my xml file.

input {
file {
path => "/Users/srini/Downloads/imp/2016-01-27/*.xml"
start_position => "beginning"

filter {
xml {
source => "message"
target => "xmldata"
store_xml => "false"
add_tag => [ "foo_%{somefield}" ]

output {
elasticsearch {
action => "index"
hosts => ""
index => "srini2"

stdout { codec => json }

I have nested data.
The data when i searched in elasticsearch, it is indexing each line.
How can i make sure,

  1. Is there any mistake with my logstash config file.?
  2. index whole file instead of line. ?

Thank You,

The file input isn't geared towards this use case. You need to use a multiline codec to join all lines of the file into a single event or a completely different input plugin that can slurp the whole file at once (like exec).

Hi @magnusbaeck,

Thanks for the details. I have resolved with using multilines. I forgot to close the topic.