Should this be moved to a codec?

[andrewvc]

It's kind of crazy, but we don't have an XML codec! Should this code be moved to a codec, and the filter deprecated?

[colinsurprenant]

I agree that we should have an xml codec, but many users still need it as a filter, sometimes the xml is embedded within the raw data, same for json, we have both the codec and the filter. Now, the real question is if we should be able to run codecs as a filters, with something like a filter-codec plugin, I believe this has been suggested before and in particular I think @jsvd proposed a PR for this?

This would DRY up the double codec/filter implementations...

[guyboertje]

I think people may need a multiline codec in their input.

This may be solved by my input refactor (poc pending in xmas period) that will enable codec chaining in the input. But then a xml codec is needed for the chain.

[andrewvc]

It sounds like the right action plan would be:

1. Make a codec
2. Determine if a codec-filter makes sense. I'm personally +1 on the idea. Much more DRY/sane.

[colinsurprenant]

created issue elastic/logstash#4383 to keep track of the filter-codec idea.