title: Parsing two formats of log messages in LogStash
body: <p>In a single log file, there are two formats of log messages. First as so:</p>
  
  <pre><code>Apr 22, 2017 2:00:14 AM org.activebpel.rt.util.AeLoggerFactory info
  INFO:
  ======================================================
  ActiveVOS 9.* version Full license.
  Licensed for All application server(s), for 8 cpus,
  License expiration date: Never.
  ======================================================
  </code></pre>
  
  <p>and second:</p>
  
  <pre><code>Apr 22, 2017 2:00:14 AM org.activebpel.rt.AeException logWarning
  WARNING: The product license does not include Socrates.
  </code></pre>
  
  <p>First line is same, but on the other lines, there can be (written in pseudo) :<br><code>loglevel: &lt;msg&gt;</code>, or<br> <code>loglevel:&lt;newline&gt;&lt;many of =&gt;&lt;newline&gt;&lt;multiple line msg&gt;&lt;newline&gt;&lt;many of =&gt;</code></p>
  
  <p>I have the following configuration:<br>
  Query:<br></p>
  
  <pre><code>%{TIMESTAMP_MW_ERR:timestamp} %{DATA:logger} %{GREEDYDATA:info}%{SPACE}%{LOGLEVEL:level}:(%{SPACE}%{GREEDYDATA:msg}|%{SPACE}=+(%{GREEDYDATA:msg}%{SPACE})*=+)
  </code></pre>
  
  <p>Grok patterns:<br></p>
  
  <pre><code>AMPM (am|AM|pm|PM|Am|Pm)
  TIMESTAMP_MW_ERR %{MONTH} %{MONTHDAY}, %{YEAR} %{HOUR}:%{MINUTE}:%{SECOND} %{AMPM}
  </code></pre>
  
  <p>Multiline filter:<br></p>
  
  <pre><code>%{LOGLEVEL}|%{GREEDYDATA}|=+
  </code></pre>
  
  <p>The problem is that all messages are always identified with <code>%{SPACE}%{GREEDYDATA:msg}</code>, and so in second case return <code>&lt;many of =&gt;</code> as <code>msg</code>, and never with <code>%{SPACE}=+(%{GREEDYDATA:msg}%{SPACE})*=+</code>, probably as first <code>msg</code> pattern contains the second.</p>
  
  <p>How can I parse these two patterns of <code>msg</code> ?</p>