Untitled

JAVACLASS (?:[a-zA-Z0-9-]+\.)+[A-Za-z0-9$]+

JAVALOGMESSAGE (.*)# MMM dd, yyyy HH:mm:ss eg: Jan 9, 2014 7:13:13 AM

CATALINA_DATESTAMP %{MONTH} %{MONTHDAY}, 20%{YEAR} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) (?:AM|PM)

CATALINALOG %{CATALINA_DATESTAMP:timestamp} %{JAVACLASS:class} %{JAVALOGMESSAGE:logmessage}

---------------------------------------------------------------

    grok

    {

        patterns_dir => [ "/home/pcrook/logstash-testing/catalina.out/patterns" ]

        match =>

        {

            "message" => "(?m)%{CATALINALOG}"

        }

    }

---------------------------------------------------------------

{

    "@timestamp" => "2015-05-29T22:07:09.090Z",

       "message" => "Debug:[2015-04-16T16:23:14Z] Response: {\n  \"code\": 200,\n  \"meta\": {\n    \"all\": {\n      \"avg\": 14,\n      \"key\": \"all\",\n      \"max\": 717,\n      \"min\": 1,\n      \"n\": 6701\n    },\n    \"ip\": \"10.100.13.81\",\n    \"status\": {\n      \"avg\": 4,\n      \"key\": \"status\",\n      \"max\": 47,\n      ",

      "@version" => "1",

          "tags" => [

        [0] "multiline",

        [1] "_grokparsefailure"

    ],

          "host" => "tanktop",

          "path" => "/home/pcrook/logstash-testing/catalina.out/catalina.out.huge"

}