title: logstash multiline codec with java stack trace
body: <p>I am trying to parse a log file with grok. the configuration I use allows me to parse a single lined event but not if multilined (with java stack trace).</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>#what i get on KIBANA for a single line:
  {
    "_index": "logstash-2015.02.05",
    "_type": "logs",
    "_id": "mluzA57TnCpH-XBRbeg",
    "_score": null,
    "_source": {
      "message": " -  2014-01-14 11:09:35,962 [main] INFO  (api.batch.ThreadPoolWorker)   user.country=US",
      "@version": "1",
      "@timestamp": "2015-02-05T09:38:21.310Z",
      "path": "/root/test2.log",
      "time": "2014-01-14 11:09:35,962",
      "main": "main",
      "loglevel": "INFO",
      "class": "api.batch.ThreadPoolWorker",
      "mydata": "  user.country=US"
    },
    "sort": [
      1423129101310,
      1423129101310
    ]
  }
  
  #what i get for a multiline with Stack trace:
    {
    "_index": "logstash-2015.02.05",
    "_type": "logs",
    "_id": "9G6LsSO-aSpsas_jOw",
    "_score": null,
    "_source": {
      "message": "\tat oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:20)",
      "@version": "1",
      "@timestamp": "2015-02-05T09:38:21.380Z",
      "path": "/root/test2.log",
      "tags": [
        "_grokparsefailure"
      ]
    },
    "sort": [
      1423129101380,
      1423129101380
    ]
  }</code></pre>
  <pre class="snippet-code-html lang-html prettyprint-override"><code>input {
    file {
      path =&gt; "/root/test2.log"
      start_position =&gt; "beginning"
      codec =&gt; multiline {
        pattern =&gt; "^ -  %{TIMESTAMP_ISO8601} "
        negate =&gt; true
        what =&gt; "previous"
      }
    }
  }
  
  filter {
   grok {
      match =&gt; [ "message", " -%{SPACE}%{SPACE}%{TIMESTAMP_ISO8601:time} \[%{WORD:main}\] %{LOGLEVEL:loglevel}%{SPACE}%{SPACE}\(%{JAVACLASS:class}\) %{GREEDYDATA:mydata} %{JAVASTACKTRACEPART}"]
    }
      date {
      match =&gt; [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
    }
  }
  
  output {
    elasticsearch {
      host =&gt; "194.3.227.23"
    }
   # stdout { codec =&gt; rubydebug}
  }</code></pre>
  </div>
  </div>
  </p>
  
  <p>Can anyone please tell me what i'm doing wrong on my configuration file? Thanks. 
  here's a sample of my log file:
   -  2014-01-14 11:09:36,447 [main] INFO  (support.context.ContextFactory) Creating default context
   -  2014-01-14 11:09:38,623 [main] ERROR (support.context.ContextFactory) Error getting connection to database jdbc:oracle:thin:@HAL9000:1521:DEVPRINT, with user cisuser and driver oracle.jdbc.driver.OracleDriver
  java.sql.SQLException: ORA-28001: the password has expired
      at oracle.jdbc.driver.SQLStateMapping.newSQLException(SQLStateMapping.java:70)
      at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:131)
  **</p>
  
  <p>*> EDIT: here's the latest configuration i'm using</p>
  
  <blockquote>
    <p><a href="https://gist.github.com/anonymous/9afe80ad604f9a3d3c00#file-output-L1" rel="nofollow">https://gist.github.com/anonymous/9afe80ad604f9a3d3c00#file-output-L1</a>*</p>
  </blockquote>
  
  <p>**</p>