Xml-file too big for logstash?

If you run a split filter against a very large field then split is very memory intensive (it creates a copy of the very large field for each entry in that field). That could be optimized out, but split does not do that. Try this.