m009$ cat /etc/filebeat/filebeat.yml
filebeat.prospectors:
- type: log
  enabled: true
  paths:
  - /var/log/jenkins/jenkins.log
  multiline.pattern: '^[A-Z]{1}[a-z]{2} {1,2}[0-9]{1,2}, [0-9]{4} {1,2}[0-9]{1,2}:[0-9]{2}:[0-9]{2}'
  multiline.negate: true
  multiline.match: after

output.logstash:
  hosts: ["myhost:5044"]