input { stdin { codec => multiline { pattern => "^\[" negate => true what => "previous" } } } filter{ grok{ match => {"message" => "(?m)^\[%{DATA:logdate}\] \[%{WORD:thread_trace_id}*\] \[%{WORD:biz_id}*\] \[%{LOGLEVEL:level}%{SPACE}*\] \[%{DATA:threadName}\] \[%{DATA:loggerName}\] \[%{DATA:method_line}\] - %{GREEDYDATA:msg}"} } date{ match => ["logdate","yyyy-MM-dd HH:mm:ss.SSS"] } } output { stdout { } }