How can we put multiline filter for below custom log

[KashinathPatil (Kashspace)]

MachineName: PC00287
TimeStamp: 12/19/2019 6:18:33 PM
FullName: POA.ReaserchSolution.Infrastructure.Logging, Version=2.51.7292.26907, Culture=neutral, PublicKeyToken=null
AppDomainName: /RM/W3SVC/4/ROOT-2-132212323240900481
WindowsIdentity: IIS APPPOOL\shop
Message: The content type text/html; charset=utf-8 of the response message does not match the content type of the binding (application/soap+xml; charset=utf-8).
stack trace:
at System.ServiceModel.Channels.HttpChannelUtilities.ValidateRequestReplyResponse(HttpWebRequest request, HttpWebResponse response, HttpChannelFactory`1 factory, WebException responseException, ChannelBinding channelBinding)

MachineName: PC00287
TimeStamp: 12/20/2019 6:18:34 PM
FullName: POA.ReaserchSolution.Infrastructure.Logging, Version=2.51.7292.26907, Culture=neutral, PublicKeyToken=null
AppDomainName: /RM/W3SVC/4/ROOT-2-132212323240900481
WindowsIdentity: IIS APPPOOL\shop
Message: The content type text/html; charset=utf-8 of the response message does not match the content type of the binding (application/soap+xml; charset=utf-8).
stack trace:
at System.ServiceModel.Channels.HttpChannelUtilities.ValidateRequestReplyResponse(HttpWebRequest request, HttpWebResponse response, HttpChannelFactory`1 factory, WebException responseException, ChannelBinding channelBinding)

MachineName: PC00288
TimeStamp: 12/21/2019 6:18:35 PM
FullName: POA.ReaserchSolution.Infrastructure.Logging, Version=2.51.7292.26907, Culture=neutral, PublicKeyToken=null
AppDomainName: /RM/W3SVC/4/ROOT-2-132212323240900481
WindowsIdentity: IIS APPPOOL\shop
Message: The content type text/html; charset=utf-8 of the response message does not match the content type of the binding (application/soap+xml; charset=utf-8).
stack trace:
at System.ServiceModel.Channels.HttpChannelUtilities.ValidateRequestReplyResponse(HttpWebRequest request, HttpWebResponse response, HttpChannelFactory`1 factory, WebException responseException, ChannelBinding channelBinding)

MachineName: PC00288
TimeStamp: 12/21/2019 6:18:35 PM
FullName: POA.ReaserchSolution.Infrastructure.Logging, Version=2.51.7292.26907, Culture=neutral, PublicKeyToken=null
AppDomainName: /RM/W3SVC/4/ROOT-2-132212323240900481
WindowsIdentity: IIS APPPOOL\shop
Message: The content type text/html; charset=utf-8 of the response message does not match the content type of the binding (application/soap+xml; charset=utf-8).
stack trace:
at System.ServiceModel.Channels.HttpChannelUtilities.ValidateRequestReplyResponse(HttpWebRequest request, HttpWebResponse response, HttpChannelFactory`1 factory, WebException responseException, ChannelBinding channelBinding)

[Marta_Zagrajek]

It is good to use multiline in filebeat. Do you have that configuration there?

[KashinathPatil (Kashspace)]

It doesnt matter. even from filebeat we require to filter the data.

[Marta_Zagrajek]

Could you include your filebeat and logstash configuration file?

[Marta_Zagrajek]

It can be something like that, if all those begin with Machine

^MachineName:\s\D{2}\d{5}

or more universal:

^MachineName.*

[KashinathPatil (Kashspace)]

@Marta_Zagrajek

something like that, if all those begin with Machine

Thanks, anyway I have created the filter
grok {
patterns_dir => "C:/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.1.2/patterns"
match => [ "message", "\sMachineName: %{HOSTNAME:HostName}\s\n\sTimeStamp: %{DATESTAMP:myLogDate} PM\sFullName: %{JAVACLASS:className}, Version=%{BASE16FLOAT:className}.%{BASE16NUM:className}%{GREEDYDATA:className}\sAppDomainName: %{URIPATHPARAM:URL}%{GREEDYDATA}\sWindowsIdentity: %{GREEDYDATA:WinIdentity}\s*" ]

}