Logstash grok pattern issue

If the log message is really spread across four lines you will need a multiline codec to join them back together before you grok them. You may be able to use a regexp that matches the timestamp to do that.