XML parsing using logstash

This might help: Split ES event