Logstash config file for laravel logs

laravel.conf

input {
  file {
    path => "/var/www/laravel-project/storage/logs/laravel.log"
    codec => multiline {
      pattern => "^\[%{TIMESTAMP_ISO8601:timestamp}\]"
      what => "previous"
      negate => true
    }
  }
}

filter {
  grok {
    match => {
      "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:env}\.%{DATA:severity}: (?<log>[^{]+)?%{GREEDYDATA:raw-json}"
    }
  }

  json {
    source => "raw-json"
    target => "json"
  }

  mutate {
    rename => { "message" => "raw-message" }
    rename => { "json" => "raw-json" }
  }
}

output {
  elasticsearch {
    hosts => "127.0.0.1:9200"
    user => "user"
    password => "pass"
    index => "laravel-logs"
  }
}

Nice thanks! This works fine for messages with texet ending with json like: [2022-05-16 12:03:50] dev.INFO: Update successful for user {"idmember":"37774", "idcard":"320000H","name":"DAVID"} If you want to add text after the json your filter can be:

 filter {
  grok {
    match => {
      "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:env}\.%{DATA:severity}: (?<log>[^{]+)?%{GREEDYDATA:raw-json}"
    }
  }

  grok {
    match => {
      "raw-json" => "(?<raw-process-json>\{(.*)\})%{GREEDYDATA:response}"
      tag_on_failure => [ ]
    }
  }

  json {
    source => "raw-process-json"
    target => "json"
  }

  mutate {
    rename => { "message" => "raw-message" }
    rename => { "json" => "raw-process-json" }
  }
}