Hi Aaron. I got it to work. Thanks for your help!!
For completeness I added the steps below.
1. Multiline filter to combine the multi line messages into one line
multiline {
patterns_dir => "path_to_grok_patterns"
pattern => "(^%{TOMCAT_DATESTAMP})|(^%{CATALINA_DATESTAMP})"
negate => true
what => "previous"
}
2. Parsed the message into separate fields using available patterns
grok {
patterns_dir => "path_to_grok_patterns"
match => { "message" => "%{CATALINA_DATESTAMP:timestamp} %{JAVACLASS:java_class} %{WORD:java_method}%{GREEDYDATA:error_msg}" }
}
3. Replaced the @timestamp logstash field with the timestamp data from the file
date {
match => [ "timestamp", "MMM dd, yyyy HH:mm:ss a" ]
}
Regards,
Frank