title: Logstash, split event from an xml file in multiples documents keeping information from root tags
body: <p>My problem:
  I have XML files that contain events I want to parse using Logstash to request it using Kibana after. I want to keep all the information from the ROOT tag in each event.</p>
  
  <p>Input looks like :</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;ROOT number="34"&gt;
    &lt;EVENTLIST&gt;
      &lt;EVENT name="hey"/&gt;
      &lt;EVENT name="you"/&gt;
    &lt;/EVENTLIST&gt;
  &lt;/ROOT&gt;
  </code></pre>
  
  <p>What I want, two documents like that:</p>
  
  <pre><code>{
    "number":"34"
    "name": "Hey"
  }
  {
    "number":"34"
    "name": "you"
  }
  </code></pre>
  
  <p>Logstash conf:</p>
  
  <pre><code>input {
    stdin { }
  }
  filter {
    xml {
      store_xml =&gt; "false"
      source =&gt; "message"
      target =&gt; "EVENT"
      xpath =&gt; [
        "/ROOT/@number","number",
        "/ROOT/EVENTLIST/EVENT/@name","name"
      ]
    }
  }
  output { elasticsearch { host =&gt; localhost } stdout { codec =&gt; rubydebug } }
  </code></pre>
  
  <p>Didnt work. What I get :</p>
  
  <pre><code>{
    "number" : ["34"]
    "name":["hey,"you""]
  }
  </code></pre>
  
  <p>I followed the solution of this post : <a href="https://serverfault.com/questions/615196/logstash-parsing-xml-document-containing-multiple-log-entries">https://serverfault.com/questions/615196/logstash-parsing-xml-document-containing-multiple-log-entries</a></p>
  
  <p>But my problem remains, I lose information from root tag.</p>
  
  <p>One of solution could be to use some ruby filter to handle that, but I don't know ruby.
  Another is to use some java programing to convert XML into JSON before sending it to elasticsearch...</p>
  
  <p>Any ideas to handle that or do I have to learn ruby?</p>