logstash-wikimedia-xml.conf

input {
  stdin {}
}

filter {
  multiline {
    pattern => "^\s\s(\s\s|\<\/doc>)"
    what => "previous"
  }

  if "multiline" in [tags] {
    mutate {
      replace => ["message",'<?xml version="1.0" encoding="UTF-8" ?>%{message}</doc>']
    }

    xml {
      target => doc
      source => message
      add_field => {
          title => "%{[doc][title]}"
          url => "%{[doc][url]}"
          abstract => "%{[doc][abstract]}"
      }
    }

    mutate {
      remove_field => ["message"]
    }
  }
}

output {
  elasticsearch { 
    host => "es1"
    port => "9200"
    protocol => "http"
  }
  stdout { codec => rubydebug }
}