Xml filtering subfields

Elastic Stack Logstash
7

Alright, I changed everythig back again so that it is exactly like your suggestion, and that's what I get for the message field:

 "message" => "<xmldata>\r\n<Event xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"><System><Provider Name=\"Microsoft-Windows-AAD\" Guid=\"{4de9bc9c-b27a-43c9-8994-0915f1a5e24f}\"></Provider>\r\n<EventID Qualifiers=\"\">1089</EventID>\r\n<Version>0</Version>\r\n<Level>2</Level>\r\n<Task>101</Task>\r\n<Opcode>0</Opcode>\r\n<Keywords>0x4000000000000012</Keywords>\r\n<TimeCreated SystemTime=\"2019-02-01 15:08:46.508312\"></TimeCreated>\r\n<EventRecordID>19</EventRecordID>\r\n<Correlation ActivityID=\"{0114a2a5-ba40-0001-b6a2-140140bad401}\" RelatedActivityID=\"\"></Correlation>\r\n<Execution ProcessID=\"692\" ThreadID=\"696\"></Execution>\r\n<Channel>Microsoft-Windows-AAD/Operational</Channel>\r\n<Computer>xxx</Computer>\r\n<Security UserID=\"S-1-5-18\"></Security>\r\n</System>\r\n<EventData><Data Name=\"Status\">0xc00484b2</Data>\r\n</EventData>\r\n</Event>\r\n<Event xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"><System><Provider Name=\"Microsoft-Windows-AAD\" Guid=\"{4de9bc9c-b27a-43c9-8994-0915f1a5e24f}\"></Provider>\r\n<EventID Qualifiers=\"\">1104</EventID>\r\n<Version>0</Version>\r\n<Level>2</Level>\r\n<Task>101</Task>\r\n<Opcode>0</Opcode>\r\n<Keywords>0x4000000000000012</Keywords>\r\n<TimeCreated SystemTime=\"2019-02-01 15:08:46.508322\"></TimeCreated>\r\n<EventRecordID>20</EventRecordID>\r\n<Correlation ActivityID=\"{0114a2a5-ba40-0001-b6a2-140140bad401}\" RelatedActivityID=\"\"></Correlation>\r\n<Execution ProcessID=\"692\" ThreadID=\"696\"></Execution>\r\n<Channel>Microsoft-Windows-AAD/Operational</Channel>\r\n<Computer>xxx</Computer>\r\n<Security UserID=\"S-1-5-18\"></Security>\r\n</System>\r\n<EventData><Data Name=\"API\">Plugin initialize</Data>\r\n<Data Name=\"Result\">3221521586</Data>\r\n</EventData>\r\n</Event>\r\n<Event xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"><System><Provider Name=\"Microsoft-Windows-AAD\" Guid=\"{4de9bc9c-b27a-43c9-8994-0915f1a5e24f}\"></Provider>\r\n<EventID Qualifiers=\"\">1089</EventID>\r\n<Version>0</Version>\r\n<Level>2</Level>\r\n<Task>101</Task>\r\n<Opcode>0</Opcode>\r\n<Keywords>0x4000000000000012</Keywords>\r\n<TimeCreated SystemTime=\"2019-02-05 13:29:08.712667\"></TimeCreated>\r\n<EventRecordID>21</EventRecordID>\r\n<Correlation ActivityID=\"{bf1d25ff-bd56-0005-0026-1dbf56bdd401}\" RelatedActivityID=\"\"></Correlation>\r\n<Execution ProcessID=\"688\" ThreadID=\"692\"></Execution>\r\n<Channel>Microsoft-Windows-AAD/Operational</Channel>\r\n<Computer>xxx</Computer>\r\n<Security UserID=\"S-1-5-18\"></Security>\r\n</System>\r\n<EventData><Data Name=\"Status\">0xc00484b2</Data>\r\n</EventData>\r\n</Event>\r\n<Event xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"><System><Provider Name=\"Microsoft-Windows-AAD\" Guid=\"{4de9bc9c-b27a-43c9-8994-0915f1a5e24f}\"></Provider>\r\n<EventID Qualifiers=\"\">1104</EventID>\r\n<Version>0</Version>\r\n<Level>2</Level>\r\n<Task>101</Task>\r\n<Opcode>0</Opcode>\r\n<Keywords>0x4000000000000012</Keywords>\r\n<TimeCreated SystemTime=\"2019-02-05 13:29:08.712677\"></TimeCreated>\r\n<EventRecordID>22</EventRecordID>\r\n<Correlation ActivityID=\"{bf1d25ff-bd56-0005-0026-1dbf56bdd401}\" RelatedActivityID=\"\"></Correlation>\r\n<Execution ProcessID=\"688\" ThreadID=\"692\"></Execution>\r\n<Channel>Microsoft-Windows-AAD/Operational</Channel>\r\n<Computer>xxx</Computer>\r\n<Security UserID=\"S-1-5-18\"></Security>\r\n</System>\r\n<EventData><Data Name=\"API\">Plugin initialize</Data>\r\n<Data Name=\"Result\">3221521586</Data>\r\n</EventData>\r\n</Event>\r",
          "tags" => [
        [0] "multiline",
        [1] "_xmlparsefailure",
        [2] "_split_type_failure"