title: Logstash grok multiline message
body: <p>My logs are formatted like this:</p>
  
  <pre><code>2014-06-19 02:26:05,556 INFO ok
  2014-06-19 02:27:05,556 ERROR
   message:space exception
           at line 85
   solution:increase space
            remove files   
  </code></pre>
  
  <p>There are 2 types of events:</p>
  
  <p>-log on one line like the first</p>
  
  <p>-log on multiple line like the second</p>
  
  <p>I am able to process the one line event, but I am not able to process the second type, where I would like to stock the message in one variable and the solution in another.</p>
  
  <p>This is my config:</p>
  
  <pre><code>input {
   file {
      path =&gt; ["logs/*"]
      start_position =&gt; "beginning"
      codec =&gt; multiline {
                     pattern =&gt; "^%{TIMESTAMP_ISO8601} "
                     negate =&gt; true
                     what =&gt; previous
      }       
   }
  }
  filter {
   #parsing of one line event
   grok {
   patterns_dir =&gt; "./patterns"
   match=&gt;["message","%{TIMESTAMP_ISO8601:timestamp} %{WORD:level} ok"]
   }
  #the parsing fail, so we assumed we are in multiline events, now I process them and I am stuck when I am getting to the new line.
  if "_grokparsefailure" in [tags] {
   grok {
   patterns_dir =&gt; "./patterns"
   match=&gt;["message","%{TIMESTAMP_ISO8601:timestamp} %{WORD:level}\r\n"]
   }
  }
  
  }
  </code></pre>
  
  <p>So this is what I have done, and I would like to have in my console output the following:</p>
  
  <pre><code>{
  "@timestamp" =&gt; "2014-06-19 00:00:00,000"
  "path" =&gt; "logs/test.log"
  "level"=&gt;"INFO"
  },
  {
  "@timestamp" =&gt; "2014-06-19 00:00:00,000"
  "path" =&gt; "logs/test.log"
  "level"=&gt;"ERROR"
  "message" =&gt; "space exception at line 85"
  "solution"=&gt;"increase space remove files"
  }
  </code></pre>
  
  <p>Concretely, I would like to get all the expression between two words ("message" and "solution" for the message variable, "solution" and the end of event for the solution variable), and that no matter if the expression is on one or multiple lines.</p>
  
  <p>Thanks in advance</p>