Easy questions.
Where data comes into logstash as XML, I can use xpath in the XML filter to pull out specific information from the XML structure and store it in a new field.
Is there a way to do this when the document coming into logstash is JSON ?
No, because XPath applies to XML and XML and JSON are different things. However, Logstash could be made to support JSON Pointer which is similar to XPath. What do you want to do, exactly?