logstash-config.conf

input {
  file {
    path => ["/var/log/knewton/*/*.log"]
    type => "knewton_logback"
  }
}

filter {
  grok {
    type => "knewton_logback"
    patterns_path => "/usr/local/share/grok/patterns"
    pattern => ["%{JAVALOGBACK}"]
    named_captures_only => false
  }


  date {
    type => "knewton_logback"
    knewton_timestamp => "yyyy-MM-dd HH:mm:ss,SSS"
    # the above line will require you to change your JAVALOGBACK pattern to name 'timestamp' 'knewton_timestamp'
  }

  multiline {
    type => "knewton_logback"
    pattern => "^[0-9]{4}-[0-9]{2}-[0-9]{2} " # This goes with
    negate => true                            # this
    # pattern => "^(\s+|com|org|net|Caused)" # Doesn't work as well
    what => "previous"
  }
}

output {
  gelf {
    host => "graylog2.utility.knewton.net"
    facility => "Platform"
  }
  stdout {
    debug => true
  }


}