title: Logstash grok filter config for php monolog multi-line(stacktrace) logs
body: <pre><code>[2018-02-12 09:15:43] development.WARNING: home page  
  [2018-02-12 09:15:43] development.INFO: home page  
  [2018-02-12 10:22:50] development.WARNING: home page  
  [2018-02-12 10:22:50] development.INFO: home page  
  [2018-02-12 10:22:50] development.ERROR: Call to undefined function vie() {"exception":"[object](Symfony\\Component\\Debug\\Exception\\FatalThrowableError(code: 0): Call to undefined function vie() at /var/www/html/routes/web.php:16 
  [stacktrace]
  #0 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Route.php(198): Illuminate\\Routing\\Router-&gt;{closure}()
  #1 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Route.php(172): Illuminate\\Routing\\Route-&gt;runCallable()
  #2 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Router.php(658): Illuminate\\Routing\\Route-&gt;run()
  #3 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(30): Illuminate\\Routing\\Router-&gt;Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))
  #4 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Middleware/SubstituteBindings.php(41): Illuminate\\Routing\\Pipeline-&gt;Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))
  #5 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Illuminate\\Routing\\Middleware\\SubstituteBindings-&gt;handle(Object(Illuminate\\Http\\Request), Object(Closure))
  
  .....
  .....
  .....
  
  #45 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(151): Illuminate\\Pipeline\\Pipeline-&gt;then(Object(Closure))
  #46 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(116): Illuminate\\Foundation\\Http\\Kernel-&gt;sendRequestThroughRouter(Object(Illuminate\\Http\\Request))
  #47 /var/www/html/public/index.php(55): Illuminate\\Foundation\\Http\\Kernel-&gt;handle(Object(Illuminate\\Http\\Request))
  #48{main}
  "}
  </code></pre>
  
  <p>Above is my Laravel monolog sample log data. I am using Logstash to read the log data and sent it to Elasticsearch. Below is my logstash.conf file</p>
  
  <pre><code>input {
    file {
      path =&gt; '/var/www/html/php-app/application/storage/logs/laravel-*.log'
      start_position =&gt; 'beginning'
      ignore_older =&gt; 0
    }
  }
  filter {
    grok {
      match =&gt; { "message" =&gt; "\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:env}\.%{DATA:severity}: %{DATA:message}at %{DATA:trace}" }
    }
  }
  output {
    elasticsearch {
      hosts =&gt; [ 'localhost:9200' ]
      index =&gt; "laravel-%{+YYYY-MM-dd}"
    }
    stdout {
      codec =&gt; rubydebug
    }
  }
  </code></pre>
  
  <p>Above configuration is working for single line log messages. For example below log message</p>
  
  <pre><code>[2018-02-12 09:15:43] development.WARNING: home page
  </code></pre>
  
  <p>generates the output as</p>
  
  <pre><code>"timestamp": "2018-02-12 10:57:25",
  "@timestamp": "2018-02-12T10:57:26.614Z",
  "severity": "INFO",
  "path": "/var/www/html/php-app/application/storage/logs/laravel-2018-02-12.log",
  "message": "[2018-02-12 10:57:25] development.INFO: home page  ",
  "env": "development"
  </code></pre>
  
  <p>But for Multiline messages(i.e - message with stacktrace), it generates like below for each line. </p>
  
  <pre><code>"@timestamp" =&gt; 2018-02-12T10:56:47.785Z,
  "path" =&gt; "/var/www/html/php-app/application/storage/logs/laravel-2018-02-12.log",
  "message" =&gt; "#1 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Illuminate\\\\Foundation\\\\Http\\\\Middleware\\\\ValidatePostSize-&gt;handle(Object(Illuminate\\\\Http\\\\Request), Object(Closure))",
  "tags" =&gt; [
      [0] "_grokparsefailure"
  ],
  </code></pre>
  
  <p>I have tried <strong>multi-line</strong> filter too. Still no success for multi-line error logs. I need a solution which suits for both multi-line and single line error messages.</p>
  
  <p>Please help me in find right grok config which suits for both single line and multi-line error logs .</p>