logstash-forwarder join

gistfile1.txt

    {
      "paths": [ "/a/path" ],
      "fields": { "type": "a_type" },
      "join": [
         {
              "not": "^\\d{4}-\\d{2}-\\d{2}",
              "with": "previous"
         }
      ]
    }