Logstash grok multiline message

Question

My logs are formatted like this:

2014-06-19 02:26:05,556 INFO ok
2014-06-19 02:27:05,556 ERROR
 message:space exception
         at line 85
 solution:increas         


        

Answer 1

As for multiline grok, it's best to use special flag for pattern string:

grok {
    match => ["message", "(?m)%{SYSLOG5424LINE}"]
}