title: Grabbing multiple lines using Grok
body: <p>The following is a log sample I need to parse using logstash and the logstash grok filter:</p>
  
  <pre><code>2018-02-12 15:17:39.216 [DEBUG] [    60] [CashTransactionReportCommand] [4564 456] - Xml of valid cash: &lt;NewDataSet&gt;
    &lt;Table&gt;
      &lt;transaction_id&gt;546464&lt;/transaction_id&gt;
      &lt;device_trans_id&gt;24&lt;/device_trans_id&gt;
      &lt;value&gt;3.5000&lt;/value&gt;
      &lt;product_code&gt;40&lt;/product_code&gt;
      &lt;product_pa_code&gt;E1&lt;/product_pa_code&gt;
      &lt;catalog_number /&gt;
      &lt;decimal_place&gt;2&lt;/decimal_place&gt;
      &lt;site_id&gt;2&lt;/site_id&gt;
      &lt;machineSeTime&gt;2018-02-12T17:17:39.273+00:00&lt;/machineSeTime&gt;
      &lt;payment_method_id&gt;3&lt;/payment_method_id&gt;
      &lt;actor_id&gt;4566&lt;/actor_id&gt;
      &lt;operator_id&gt;55&lt;/operator_id&gt;
    &lt;/Table&gt;
  &lt;/NewDataSet&gt;
  </code></pre>
  
  <p>I almost have everything I need:</p>
  
  <pre><code>%{TIMESTAMP_ISO8601:log_timestamp} \[%{LOGLEVEL:loglevel}\] \[%{DATA:snId}\] \[%{WORD:snName}\] (?&lt;test&gt;\[\d+ \d+\]) %{GREEDYDATA:logmessage}
  </code></pre>
  
  <p>My only problem with the "logmessage". I need it to contain everything passed "[4564 456]" until the end of the example.</p>