XML parsing logstash, adding part of XML tags to an array per event

Comment out all your filters and show us the result of your stdout { codec => rubydebug } output so we can see that the multiline codec is doing the right thing. I think your problems start there.