title: How to process multiline log entry with logstash filter?
body: <h2>Background:</h2>
  
  <p>I have a custom generated log file that has the following pattern :</p>
  
  <pre><code>[2014-03-02 17:34:20] - 127.0.0.1|ERROR| E:\xampp\htdocs\test.php|123|subject|The error message goes here ; array (
    'create' =&gt; 
    array (
      'key1' =&gt; 'value1',
      'key2' =&gt; 'value2',
      'key3' =&gt; 'value3'
    ),
  )
  [2014-03-02 17:34:20] - 127.0.0.1|DEBUG| flush_multi_line
  </code></pre>
  
  <p>The second entry <code>[2014-03-02 17:34:20] - 127.0.0.1|DEBUG| flush_multi_line</code> Is a dummy line, just to let logstash know that the multi line event is over, this line is dropped later on.</p>
  
  <p>My config file is the following :</p>
  
  <pre><code>input {
    stdin{}
  }
  
  filter{
    multiline{
        pattern =&gt; "^\["
        what =&gt; "previous"
        negate=&gt; true
    }
    grok{
      match =&gt; ['message',"\[.+\] - %{IP:ip}\|%{LOGLEVEL:loglevel}"]
    }
  
    if [loglevel] == "DEBUG"{ # the event flush  line
      drop{}
    }else if [loglevel] == "ERROR"  { # the first line of multievent
      grok{
        match =&gt; ['message',".+\|.+\| %{PATH:file}\|%{NUMBER:line}\|%{WORD:tag}\|%{GREEDYDATA:content}"] 
      }
    }else{ # its a new line (from the multi line event)
      mutate{
        replace =&gt; ["content", "%{content} %{message}"] # Supposing each new line will override the message field
      }
    }  
  }
  
  output {
    stdout{ debug=&gt;true }
  }
  </code></pre>
  
  <p>The output for <strong>content</strong> field is : <code>The error message goes here ; array (</code></p>
  
  <h2>Problem:</h2>
  
  <p>My problem is that I want to store the rest of the multiline to content field :</p>
  
  <pre><code>The error message goes here ; array (
    'create' =&gt; 
    array (
      'key1' =&gt; 'value1',
      'key2' =&gt; 'value2',
      'key3' =&gt; 'value3'
    ),
  )
  </code></pre>
  
  <p>So i can remove the message field later.</p>
  
  <p>The <strong>@message</strong> field contains the whole multiline event so I tried the <strong>mutate filter</strong>, with the <strong>replace</strong> function on that, but I'm just unable to get it working :( .</p>
  
  <p>I don't understand the Multiline filter's way of working, if someone could shed some light on this, it would be really appreciated.</p>
  
  <p>Thanks,</p>
  
  <p>Abdou.</p>