I have some problem about the log's format that I had to parse. My logs have a format like this:
Report : WARNING
Date : Thu Jun 18 16:52:54 2017
Description : Did not install signal handlers to cleanup resources.
Node : swim-host
Process : java <14517>
Thread : main thread 40ea6940
Internals : V6.3.130716OSS
Report : INFO
Date : Thu Jun 18 16:52:59 2017
and following like that. So in my case the separator between the single instances is the sequence of 88 "=". But grok filter considers by default as separator the end of line. So when I start logstash I have a grokparsefailure because it applies the grok filter, that I wrote for the entire instance, to just one line. For example if I try to parse a .log file whit just one instance of collected data and I start logstash I have 8 grokparsefailure, one for each line. I tried with the codec multiline or the gsub mutate filter but I couldn't solve the problem. How can I solve the issue?