title: Defining a grok filter over multiple lines in logstash
body: <p>I have a very long logstash grok filter:</p>
  
  <pre><code>match =&gt; { 'message' =&gt; '%{MONTH:month} %{NUMBER:day} %{TIME:time} %{WORD:log_host} %{WORD:generator}\[%{NUMBER:unknown}\]: %{IP:connIP}:%{NUMBER:connPort} \[.*\] %{WORD:namespace}\~? %{NOTSPACE:unknown} %{NOTSPACE:unknown} %{NUMBER:res_statuscode} %{NUMBER:unknown} (?&lt;unknown&gt;\-.*\-) %{NOTSPACE:unknown} %{NOTSPACE:unknown} \"%{WORD:method} %{PATH:path} %{DATA:httpversion}\"' }
  </code></pre>
  
  <p>Any way to break this up over multiple lines? I tried the following:</p>
  
  <pre><code>match =&gt; { 'message' =&gt; '%{MONTH:month} %{NUMBER:day} %{TIME:time} %{WORD:log_host}'
                                  ' %{WORD:generator}\[%{NUMBER:unknown}\]: %{IP:connIP}:%{NUMBER:connPort}'
                                  ' \[.*\] %{WORD:namespace}\~? %{NOTSPACE:unknown} %{NOTSPACE:unknown}'
                                  ' %{NUMBER:res_statuscode} %{NUMBER:unknown} (?&lt;unknown&gt;\-.*\-) %{NOTSPACE:unknown}'
                                  ' %{NOTSPACE:unknown} \"%{WORD:method} %{PATH:path} %{DATA:httpversion}\"' }
  </code></pre>
  
  <p>But it's giving me errors, even separating the strings with commas doesn't work: <code>{:timestamp=&gt;"2016-09-30T08:38:50.549000+0000", :message=&gt;"fetched an invalid config" ...</code></p>
  
  <p>There's no mention of handling this in the official documentation:</p>
  
  <ul>
  <li><a href="https://www.elastic.co/guide/en/logstash/current/filter-plugins.html" rel="nofollow">https://www.elastic.co/guide/en/logstash/current/filter-plugins.html</a></li>
  <li><a href="https://www.elastic.co/guide/en/logstash/current/config-examples.html" rel="nofollow">https://www.elastic.co/guide/en/logstash/current/config-examples.html</a></li>
  </ul>