logstash.conf file to log IIS errors in ELK

logstash.conf

#############
# Support multiple xml files
#############
input 
{
    file{
        path => ["C:/inetpub/logs/FailedReqLogFiles/*/*.xml"]
        start_position => "beginning"
        # filter is not thread safe, so have to move the multiline into the input
        codec => multiline{
            pattern => "^<\?xml version"
            negate => true
            what => "previous"
            max_lines => 12000
        }
        sincedb_path => "C:/Users/sshao/Source/elk/logstash/bin/.sincedb"
    }
}
 
filter{
    xml{
        store_xml => "false"
        source => "message"
        target => "EVENT"
        xpath => [
          "/failedRequest/@url", "url",
          "/failedRequest/@appPoolId", "appPoolId",
          "/failedRequest/@verb", "verb",
          "/failedRequest/@statusCode", "statusCode"
        ]
    } 
    # Remove the long redundant message block
    mutate
    {
        remove_field => [ "message" ]
    } 
}
 
output 
{
    elasticsearch{
        hosts => ["192.168.0.1:9200"]
        index => "testserver-logstash-%{+YYYY.MM.dd}"   
    }
    stdout 
    {
        codec => rubydebug
    }
    file{
        path => "C:/Users/sshao/Source/elk/logstash/bin/test.log"
    }
}