title: Multiline parsing pattern
body: <p>I want to parse a standard JAVA exception in ELK stack 6.3.2 version which looks like :</p>
  
  <pre><code>2018-09-04 05:29:03.955 [default task-38] ERROR c.r.e.u.util.MongoConnectionUtil.createMongoUser - Exception occured while creating mongo userCommand failed with error 11000: 'User "asdf" already exists' on server 192.168.1.33:27017. The full response is { "ok" : 0.0, "errmsg" : "User \"asdf\" already exists", "code" : 11000, "codeName" : "DuplicateKey" }
  com.mongodb.MongoCommandException: Command failed with error 11000: 'User "qwer" already exists' on server 192.168.1.33:27017. The full response is { "ok" : 0.0, "errmsg" : "User \"asdf\" already exists", "code" : 11000, "codeName" : "DuplicateKey" }
      at com.mongodb.connection.ProtocolHelper.getCommandFailureException(ProtocolHelper.java:115)
      at com.mongodb.connection.CommandProtocol.execute(CommandProtocol.java:114) ...
  </code></pre>
  
  <p>My filebeat.yml has the configuration :</p>
  
  <pre><code>filebeat.inputs:
  
  - type: log
    enabled: true
    paths:
      - C:\logs\test.log
    multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
    multiline.negate: false
    multiline.match: after
  </code></pre>
  
  <p>and my logstash.conf input looks like :</p>
  
  <pre><code>input {
  
  beats {
      port=&gt;5044
          codec =&gt; multiline {
                 pattern =&gt; "^\s"
                what =&gt; "previous"
  }
  }
  </code></pre>
  
  <p>But logstash says failed to parse the pattern, in fact it crashes with exception. If I remove the <code>codec</code> configuration then only, the first line of the exception is getting parsed. I have also put the same question at <a href="https://discuss.elastic.co/t/multiline-parsing-patterns/147171" rel="nofollow noreferrer">https://discuss.elastic.co/t/multiline-parsing-patterns/147171</a> but no response. </p>