gistfile1.txt

filter {
  mutate {
    type => json
    gsub => [
      "datetime", "[ \t]$", "",
      "process", "[ \t]{2,}", "",
      "area", "[ \t]{2,}", "",
      "category", "[ \t]{2,}", "",
      "level", "[ \t]{2,}", ""
    ]
  }
  multiline {
    pattern => "\d\d\/\d\d\/\d\d\d\d \d\d\:\d\d\:\d\d\.\d\d\*"
    what => previous
  }
  date {
    match => [ "datetime", "MM/dd/YYYY HH:mm:ss.SS", "MM/dd/YYYY HH:mm:ss.SS*" ]
  }
  mutate {
    type => json
    rename => [ "message", "@message" ]
    add_tag => "%{app}"
    add_tag => "%{tags}"
  }
  mutate {
    remove => [ "SourceModuleName", "SourceModuleType", "EventReceivedTime", "tags", "app", "datetime" ]
  }
}

filter {
  mutate {
    type => json
    gsub => [
      "datetime", "[ \t]$", "",
      "process", "[ \t]{2,}", "",
      "area", "[ \t]{2,}", "",
      "category", "[ \t]{2,}", "",
      "level", "[ \t]{2,}", ""
    ]
  }
  multiline {
    pattern => "\d\d\/\d\d\/\d\d\d\d \d\d\:\d\d\:\d\d\.\d\d\*"
    what => previous
  }
  date {
    match => [ "datetime", "MM/dd/YYYY HH:mm:ss.SS" ]
  }
  date {
    match => [ "datetime", "MM/dd/YYYY HH:mm:ss.SS*" ]
    add_field => [ "extraline", "true" ]
  }
  mutate {
    type => json
    rename => [ "message", "@message" ]
    add_tag => "%{app}"
    add_tag => "%{tags}"
  }
  mutate {
    remove => [ "SourceModuleName", "SourceModuleType", "EventReceivedTime", "tags", "app", "datetime" ]
  }
}