XML Filter

[cameronattard]

Is your feature request related to a problem? Please describe.

We want to be able to parse XML documents in log fields to make them more easily searchable in OpenSearch. This would mean we wouldn't have to rely on logging the field as a keyword and using expensive wildcard search queries to search for values within the document.

Describe the solution you'd like

Implement an XML filter, similar to what is available in Logstash - https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html.

[dlvenable]

@cameronattard ,

This would be a useful feature. I understand that you'd like a new processor for parsing XML, correct? It sounds like you are performing a grok on a log line and then some part of that log has XML. Correct?

Perhaps something like the following:

processor:
- grok:
    match:
      log: [ '... %{GREEDYDATA:my_xml_key}' ]
- parse_xml:
    source: my_xml_key

[cameronattard]

In our case we probably wouldn't even grok - the XML is usually in an existing field that's already been json-parsed.

[dlvenable]

Closed by #4191 and as a duplicate of #4165.