conf

    if [type] == "rabbitmq" {
        grep {
            match => ["message", "^\s*$"]
            negate => true
            drop => true
        }
        grok {
            patterns_dir => ["/opt/logstash/patterns"]
            match => [
                "message", "=%{WORD:report_type} REPORT=+ %{RABBITMQ_DATE:timestamp} ==="
            ]
        }
        multiline {
            patterns_dir => ["/opt/logstash/patterns"]
            pattern => "^="
            negate => true
            what => "previous"
        }

input

=INFO REPORT==== 7-Feb-2014::07:35:01 ===
accepting AMQP connection <0.2419.22> (172.20.0.200:51235 -> 172.20.0.2:5672)
\n

output

{
        "message" => "=INFO REPORT==== 7-Feb-2014::07:35:01 ===\naccepting AMQP connection <0.2419.22> (172.20.0.200:51235 -> 172.20.0.2:5672)",
       "@version" => "1",
     "@timestamp" => "2014-02-07T07:35:02.341Z",
           "type" => "rabbitmq",
           "host" => "j-a-h-1-infra1",
           "path" => "/var/log/rabbitmq/rabbit@j-a-h-1-infra1.log",
    "report_type" => "INFO",
      "timestamp" => "7-Feb-2014::07:35:01",
           "tags" => [
        [0] "_grokparsefailure",
        [1] "multiline"
    ]
}