title: grok parse multiple lines, for example exception stack trace
body: <p>I have multiple(three) types of log in my log file. One of the types has some own prints + exception stack trace. The example is listed below:</p>
  
  <pre><code>Multiple lines example:
      2018-04-27 10:53:17 [http-nio-8088-exec-4] - ERROR - app-info-exception-info - params:{"cardid":"111111111","txamt":10,"ip":"192.168.16.89","stationcode":"0002","inputuserid":1,"organcode":"99999"} java.lang.NullPointerException: null
          at com.datalook.group.BusinessHandler.handler(BusinessHandler.java:93) ~[classes/:?]
          at com.datalook.group.BusinessGroupController.businessGroup(BusinessGroupController.java:51) [classes/:?]
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_77]
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_77]
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_77]
          at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_77]
  </code></pre>
  
  <p>I have a patterns to parse it, it is:</p>
  
  <pre><code>#pattern:
  (?&lt;timestamp&gt;[\d\-\s\:]+)\s\[(?&lt;threadname&gt;[\w\-\d]+)\]\s-\s(?&lt;loglevel&gt;[\w]+)\s\-\s(?&lt;appinfo&gt;app-info-exception-info)\s-\s(?&lt;params&gt;params):(?&lt;jsonstr&gt;[\"\w\d\,\:\.\{\}]+)\s(?&lt;exceptionname&gt;[\w\d\.]+Exception):\s(?&lt;exceptiondetail&gt;[\w\d\.]+)\n\t(?&lt;extralines&gt;at[\s\w\.\d\~\?\n\t\(\)\_\[\]\/\:\-]+)\n
  </code></pre>
  
  <p>Pattern has error(actually not error, but not parse wholely or as expected) in parse the multiline exception stack trace, mostly in last two parts(exceptiondetail (null in this case) and extralines(those lines starting with space or tabs plus 'at', or lines after first line of stack trace)). Any better idea than I did? </p>
  
  <p>In filebeat.yml, I have following configured:</p>
  
  <pre><code># The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
    multiline.pattern: '^[[:space:]]'
  
    # Defines if the pattern set under pattern should be negated or not. Default is false.
    multiline.negate: false
  
    multiline.match: after
  </code></pre>
  
  <p>Any idea to improve parse multiple lines (exception stacktrace)?</p>