As @jochen already pointed out in Extracting XML fields parsing of XML should happen before putting the logs into graylog.
