patterns

filter.conf

filter {
 if "java-api" in [type] {
    multiline {
      pattern => "^%{TIMESTAMP_ISO8601}"
      negate => true
      what => "previous"
    }
    grok {
      match => [ "message", "%{API_APPLICATION_LOG}" ]
      overwrite => [ "message", "severity" ]
      break_on_match => false
    }
    date {
      match => [ "timestamp" , "YYYY-MM-dd HH:mm:ss,SSS", "YYYY-MM-dd HH:mm:ss,SSSZ", "ISO8601" ]
    }
  }
}

patterns

API_APPLICATION_LOG %{API_SECTION:timestamp} | %{API_SECTION:severity} | %{API_SECTION:app_id} | %{API_SECTION:request_id} | %{API_SECTION:javaclass} | %{API_SECTION:request}