Give this a try. THere will two extra events with header (everything before first PacketSignature) and footer (closing tag for PacketDataSummaryReport), which needs to be dropped, hence the transforms.conf is needed. props.conf [PacketSignatureXML] KV_MODE=xml TRUNCATE=0 SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)(?=\s*\<PacketSignature\>) TIME_PREFIX=\<FirstPacketTime\> TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%NZ MAX_TIMESTAMP_LOOKAHEAD = 27 TRANSFORMS-removejunk = removeheaders transforms.conf [removeheaders] REGEX = PacketDataSummaryReport FORMAT = nullQueue DEST_KEY=queue ... View more