The correct output is obtained for below input code, hope this helps other people,
Also, max_lines number changes based on the maximum number of lines present in your xml file
input
{
file
{
path => "C:/Users/LENOVO/Downloads/stations.xml"
start_position => "beginning"
sincedb_path => "NUL"
codec => multiline {
pattern => "^<?stations.*>"
negate => "true"
what => "previous"
auto_flush_interval => 1
max_lines => 3000
}
}
}
filter
{
xml
{
source => "message"
target => "parsed"
store_xml => "false"
xpath => [
"/stations/station/id/text()", "station_id",
"/stations/station/name/text()", "station_name"
]
}
mutate {
remove_field => [ "message"]
}
}
output
{
stdout
{
codec => rubydebug
}
}