How do I match a newline in grok/logstash?

Question

I have a remote machine that combines multiline events and sends them across the lumberjack protocol.

What comes in is something that looks like this:

Answer 1

All GREEDYDATA is is .*, but . doesn't match newline, so you can replace %{GREEDYDATA:message} with (?(.|\r|\n)*)and get it to be truly greedy.