Config

input {
        stdin {codec => multiline{

                 pattern => "^ -%{SPACE}%{SPACE}%{TIMESTAMP_ISO8601}"
                 negate => true
                 what => "previous"
        }  }}

filter {
    grok {
     match => [ 
       "message", "(?m)^ -%{SPACE}%{TIMESTAMP_ISO8601:time} \[%{WORD:main}\] %{LOGLEVEL:loglevel}%{SPACE}\(%{JAVACLASS:class}\) %{DATA:mydata}\n\t%{GREEDYDATA:stack}",
       "message", "^ -%{SPACE}%{TIMESTAMP_ISO8601:time} \[%{WORD:main}\] %{LOGLEVEL:loglevel}%{SPACE}\(%{JAVACLASS:class}\) %{GREEDYDATA:mydata}" 
     ]
 }
    date {
    match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
 }
}

output {
  stdout { codec => rubydebug}
}

Input

 -  2014-04-29 13:04:23,700 [main] INFO  (api.batch.ThreadPoolWorker) Loading properties from classpath resource file:/env3/logiciel/splapp/standalone/config/threadpoolworker.properties
 -  2014-01-14 11:09:38,623 [main] ERROR  (support.context.ContextFactory) Error getting connection to database jdbc:oracle, with user cisuser and driver oracle.jdbc.driver.OracleDriver
	at oracle.jdbc.driver.SQLStateMapping.newSQLException(SQLStateMapping.java:70)
	at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:131)
	at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:141)
	at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:151)
	at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:161)
 -  2014-01-14 11:09:38,623 NEEDED FOR FLUSHING LAST EVENT