Filebeat combining all log lines starting with the same timestamps to a single event

Elastic Stack Beats
1

i have apache wsgi log:

[Sun Mar 05 14:26:12.858516 2017] [wsgi:error] [pid 11254:tid 140473096181504]
[Sun Mar 05 14:26:12.859199 2017] [wsgi:error] [pid 11254:tid 140473096181504] /usr/local/lib/python3.5/dist-packages/urllib3/connectionpool.py:852: I
nsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.i
o/en/latest/advanced-usage.html#ssl-warnings
[Sun Mar 05 14:26:12.859210 2017] [wsgi:error] [pid 11254:tid 140473096181504]   InsecureRequestWarning)
[Sun Mar 05 14:26:12.859215 2017] [wsgi:error] [pid 11254:tid 140473096181504]
[Sun Mar 05 14:26:12.859640 2017] [wsgi:error] [pid 11254:tid 140473087788800] /usr/local/lib/python3.5/dist-packages/urllib3/connectionpool.py:852: I
nsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.i
o/en/latest/advanced-usage.html#ssl-warnings
[Sun Mar 05 14:26:12.859650 2017] [wsgi:error] [pid 11254:tid 140473087788800]   InsecureRequestWarning)

and i want to combine all log lines starting with this part of timestamp [Sun Mar 05 14:26:12] to a single event. How i can achive this using multiline patern?

2

TBH I can't think of a way how this could be done with the current implementation we have. Perhaps check on the logstash side if they have something that could support this.