Hmm... I think I saw something similar in the XML::Twig FAQ: Q22: I need to process XML documents. The problem is that they are several of them, so the parser dies after the first one, with a message telling me that there is junk after the end of the document. Is there any way I could trick the parser into believing they are all part of a single document?
And of course XML::Twig will let you process the document one log entry at a time, without ever needing to have more than one in memory.
And the XML brigade (which I am a proud member of) won't yell at you for parsing XML with regexp ;--)
There are pure-XML ways to fake a single document, for example by creating an entity that points to the log file and including it in a fake XML document, but I am not sure it's simpler than what the FAQ suggest (pass an open tag first to the parser, then the log file, then a close tag).