title: How to setup multiline java stack trace in Logstash and grok filter?
body: <p>I'm trying to setup multiline in grok filter (I'm using Filebeats) in order to parse java stack trace.</p>
  
  <p>Currently I able to parse the following log:</p>
  
  <pre><code>08/12/2016 14:17:32,746 [ERROR] [nlp.rvp.TTEndpoint] (Thread-38 ActiveMQ-client-global-threads-1048949322) [d762103f-eee0-4dbb-965f-9f8fb500cf92] ERROR: Not found: v1/t/auth/login: Not found: v1/t/auth/login
          at nlp.exceptions.nlpException.NOT_FOUND(nlpException.java:147)
          at nlp.utils.Dispatcher.forwardVersion1(Dispatcher.java:342)
          at nlp.utils.Dispatcher.Forward(Dispatcher.java:189)
          at nlp.utils.Dispatcher$Proxy$_$$_WeldSubclass.Forward$$super(Unknown Source)
          at sun.reflect.GeneratedMethodAccessor171.invoke(Unknown Source)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
          at java.lang.reflect.Method.invoke(Method.java:498)
          at org.jboss.weld.interceptor.proxy.TerminalAroundInvokeInvocationContext.proceedInternal(TerminalAroundInvokeInvocationContext.java:49)
  </code></pre>
  
  <p>but the result can't show the java stack trace (which begins with at java...)</p>
  
  <p>This is the Grok Debugger output (as you can see, the java stack trace is missing):</p>
  
  <pre><code>{
    "date": "08/12/2016",
    "loglevel": "ERROR",
    "logger": "nlp.rvp.TTEndpoint",
    "time": "14:17:32,746",
    "thread": "Thread-38 ActiveMQ-client-global-threads-1048949322",
    "message": "ERROR: Not found: v1/t/auth/login: Not found: v1/t/auth/login\r",
    "uuid": "d762103f-eee0-4dbb-965f-9f8fb500cf92"
  }
  </code></pre>
  
  <p><strong>This is the configuration of Filebeats (the log shipper):</strong></p>
  
  <pre><code>filebeat:
  
    prospectors:
  
      -
        paths:
          - /var/log/test
        input_type: log
        document_type: syslog
    registry_file: /var/lib/filebeat/registry
  
  output:
    logstash:
      hosts: ["192.168.1.122:5044"]
      bulk_max_size: 8192
      compression_level: 3
  
      tls:
        certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
  
  shipper:
  
  logging:
    files:
      rotateeverybytes: 10485760 # = 10MB
  </code></pre>
  
  <p><strong>This is the configuration of Logstash</strong></p>
  
  <pre><code>input {
    beats {
      port =&gt; 5044
      ssl =&gt; true
      ssl_certificate =&gt; "/etc/pki/tls/certs/logstash-forwarder.crt"
      ssl_key =&gt; "/etc/pki/tls/private/logstash-forwarder.key"
    }
  }
  
  filter {
    if [type] == "syslog" {
      grok {
        match =&gt; { "message" =&gt; "%{DATE:date} %{TIME:time} \[%{LOGLEVEL:loglevel}%{SPACE}\] \[(?&lt;logger&gt;[^\]]+)\] \((?&lt;thread&gt;[^)]+)\) \[%{UUID:uuid}\] %{GREEDYDATA:message}" }
      }
   }
  }
  
  output {
    elasticsearch {
      hosts =&gt; ["localhost:9200"]
      sniffing =&gt; true
      manage_template =&gt; false
      index =&gt; "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      document_type =&gt; "%{[@metadata][type]}"
    }
  }
  </code></pre>
  
  <p>Hope you can help me, so finally, I'll break it out (:
  Thanks!</p>