gistfile1.txt

input {
    stdin {
        codec => multiline {
            pattern => "^%{DATESTAMP} "
            negate => true
            what => "previous"
        }
    }
}

filter {
  # stuff-log filters
  grok {
    match => [ "message", "%{DATESTAMP:timestamp} \[%{NUMBER:pid}\] \[%{WORD:log_level}\] %{DATA:module}: %{GREEDYDATA:log_message}" ]
  }

  date {
    match => [ "timestamp", "yyyy-MM-dd HH:mm:ss,SSS" ]
  }
}

output {
  stdout { codec => rubydebug }
}

input {
    stdin {
        codec => multiline {
            pattern => "^(\d\d\d\d-\d\d-\d\d)"
            negate => true
            what => "previous"
        }
    }
}

filter {
  # stuff-log filters
  grok {
    match => [ "message", "%{DATESTAMP:timestamp} \[%{NUMBER:pid}\] \[%{WORD:log_level}\] %{DATA:module}: %{GREEDYDATA:log_message}" ]
  }

  date {
    match => [ "timestamp", "yyyy-MM-dd HH:mm:ss,SSS" ]
    add_field => {
        "continuation" => false
    }
  }

}

output {
  stdout { codec => rubydebug }
}