pcn/logstash-config.conf

## logstash-config.conf
input {
  file {
    path => ["/var/log/knewton/*/*.log"]
    type => "knewton_logback"
  }
}

filter {
  grok {
    type => "knewton_logback"
    patterns_path => "/usr/local/share/grok/patterns"
    pattern => ["%{JAVALOGBACK}"]
    named_captures_only => false
  }


  date {
    type => "knewton_logback"
    timestamp => "yyyy-MM-dd HH:mm:ss,SSS"
  }
  mutate {    replace => ["@level", "%{level}"]  }


  multiline {
    type => "knewton_logback"
    pattern => "^[0-9]{4}-[0-9]{2}-[0-9]{2} " # This goes with
    negate => true                            # this
    # pattern => "^(\s+|com|org|net|Caused)" # Doesn't work as well
    what => "previous"
  }
}

output {
  gelf {
    host => "graylog2.utility.knewton.net"
    facility => "Platform"
  }
  stdout {
    debug => true
  }


}
	input {
	file {
	path => ["/var/log/knewton//.log"]
	type => "knewton_logback"
	}
	}

	filter {
	grok {
	type => "knewton_logback"
	patterns_path => "/usr/local/share/grok/patterns"
	pattern => ["%{JAVALOGBACK}"]
	named_captures_only => false
	}


	date {
	type => "knewton_logback"
	timestamp => "yyyy-MM-dd HH:mm:ss,SSS"
	}
	mutate { replace => ["@level", "%{level}"] }


	multiline {
	type => "knewton_logback"
	pattern => "^[0-9]{4}-[0-9]{2}-[0-9]{2} " # This goes with
	negate => true # this
	# pattern => "^(\s+\|com\|org\|net\|Caused)" # Doesn't work as well
	what => "previous"
	}
	}

	output {
	gelf {
	host => "graylog2.utility.knewton.net"
	facility => "Platform"
	}
	stdout {
	debug => true
	}


	}