logstash-config.conf

input {
  file {
    path => ["/var/log/knewton/*/*.log"]
    type => "knewton_logback"
  }
}

filter {
  grok {
    type => "knewton_logback"
    patterns_path => "/usr/local/share/grok/patterns"
    pattern => ["%{JAVALOGBACK}"]
    named_captures_only => false
  }


  date {
    type => "knewton_logback"
    timestamp => "yyyy-MM-dd HH:mm:ss,SSS"
  }
  mutate {    replace => ["@level", "%{level}"]  }


  multiline {
    type => "knewton_logback"
    pattern => "^[0-9]{4}-[0-9]{2}-[0-9]{2} " # This goes with
    negate => true                            # this
    # pattern => "^(\s+|com|org|net|Caused)" # Doesn't work as well
    what => "previous"
  }
}

output {
  gelf {
    host => "graylog2.utility.knewton.net"
    facility => "Platform"
  }
  stdout {
    debug => true
  }


}

Using these defintions:

JAVALOGBACKTIMESTAMP %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND}),%{MILLISECOND}
JAVALOGBACK (%{JAVALOGBACKTIMESTAMP:timestamp}) (?:%{WORD:severity})