Pubmed logstash pipeline

pipeline.conf

# http://www.front2backdev.com/2015/08/26/pulling-and-splitting-live-xml/
input {
    file {
        path => "/Users/harryscells/Docker/sigir2017-elastic4ir/*.xml"
        start_position => "beginning"
        sincedb_path => "NUL"
        codec => multiline {
            pattern => "<PubmedArticle>|</PubmedArticleSet>"
            negate => true
            what => "previous"
            auto_flush_interval => 1
        }
    }
}
filter {
    if [message] == "<PubmedArticleSet>" or [message] == "</PubmedArticleSet>" {
        drop {}
    }
    xml {
        source => "message"
        target => "citation"
        force_array => false
    }
    if [citation][MedlineCitation][Article][Abstract][AbstractText][content] {
        mutate {
            add_field => { "abstract" => "%{[citation][MedlineCitation][Article][Abstract][AbstractText][content]}" }
        }
    }
    mutate {
        add_field => { "title" => "%{[citation][MedlineCitation][Article][ArticleTitle]}" }
        add_field => { "created" => "%{[citation][MedlineCitation][DateCreated][Day]}-%{[citation][MedlineCitation][DateCreated][Month]}-%{[citation][MedlineCitation][DateCreated][Year]}" }
        remove_field => ["message", "path", "@timestamp", "host"]
    }
    date {
        match => ["created", "dd-MM-yyyy"]
        target => "created"
    }
}
output {
    elasticsearch {
        hosts => "localhost:9200"
        index => "pubmed"
        document_type => "medline_citation"
        document_id => "%{[citation][MedlineCitation][PMID][content]}"
    }
    # stdout { codec => rubydebug  }
}