<event name="rpc_completed" package="sqlserver" timestamp="2018-04-30T20:41:42.698Z">
  <data name="cpu_time">
    <value>0</value>
  </data>
  <data name="duration">
    <value>187</value>
  </data>
  <data name="physical_reads">
    <value>0</value>
  </data>
  <data name="logical_reads">
    <value>27</value>
  </data>
</event>

input {
  jdbc {
       jdbc_driver_library => "XXXXX"
     jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
     jdbc_connection_string => "jdbc:sqlserver://XXXXX;databasename=XXXX"
     jdbc_user => "XXXX"
     jdbc_password => "XXXX"
     statement => "exec XXXXX1"
     type => "test"
  }
}


filter {
  xml {
    source => "data"
    store_xml => false
        xpath => [
            "event/data/duration[0]","duration",
            "event/data/physical_reads[0]","physical_reads"
            ]
        }
  }

filter {
  mutate {
    remove_field => [ "data" ,"@timestamp","type","parsed"]
  }
}

output {
  stdout { codec => json }
}