Example logstash format for parsing dropwizard logback format style logging. This parses the remainder of a message that starts with _data_ as json.

gistfile1.txt

input {
  stdin { }
  file {
    type => "applogs"

    # Wildcards work, here :)
    path => [ "/home/alee/workspaces/java-workspaces/elasticsearch-example/graph-presenter/logs/*.log" ]
  }
}

filter{
  grok{
    match => ["message", "%{WORD:level}  %{SYSLOG5424SD:time} %{JAVACLASS:class}: _data_%{GREEDYDATA:json}"]
  }
  json {
    source => "json"
  }
}
output { stdout { codec => rubydebug } }