input { file { path => "/usr/share/logstash/logs/*.log" start_position => "beginning" codec => multiline { patterns_dir => ["./patterns"] pattern => "^%{MY_TIMESTAMP}" negate => true what => "previous" } } } filter { grok { patterns_dir => ["./patterns"] match => { "message" => "%{MY_TIMESTAMP:customTimestamp} %{SYSLOG5424SD:thread} %{LOGLEVEL:loglevel}%{SPACE}%{JAVACLASS:class} - %{GREEDYDATA:msg}" } overwrite => [ "message" ] } date { match => [ "customTimestamp" , "yyyyMMdd HH:mm:ss.SSS" ] remove_field => [ "timestamp" ] } } output { elasticsearch { hosts => "elasticsearch:9200" } }