multi-line php5-fpm logstash configuration

10-php5-fpm.conf

input {
  beats {
        port => 5044
        type => "php5-fpm"
        ssl => true
        ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
        ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
    }   
}

filter {
    if [type] == "php5-fpm" {
        grok {
            match => {"message" => "message: PHP %{WORD:level}:? %{DATA:error_msg} in %{PATH:file}"}
            add_tag => ["%{level}"]
        }
        grok {
            match => {"message" => "on line %{NUMBER:line}"}
        }
        date {
            match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss", "dd-MMM-yyyy HH:mm:ss ZZZ", "dd-MMM-yyyy HH:mm:sss"]
        }
        multiline {
            pattern => "(Stack trace:)|(#\d+)|(^\"\")|(\s+thrown)|(^\s)|PHP\s+\d\."
            what => "previous"
        }
        mutate {
            uppercase => ["level"]
            lowercase => ["tags"]
            gsub => [ 
                "tags", " ", "_",
                "level", " ", "_"
            ]
        }
    }
}   

output {
  stdout { codec => rubydebug }
  elasticsearch { hosts => ["localhost:9200"] }
}