Logstash Grok pattern

Elastic Stack Logstash
1

I have the following log entry and grok pattern below, using the multiline filter in logstash. It works on http://grokconstructor.appspot.com/ but not when I use logstash.

WCCOAui      (5), 2016.04.12 10:10:37.630, CTRL, SEVERE,     79, Index out of range, 
    Module: TIP_1;unicosGFPanel
    Panel: \\cs-ccr-tip.cern.ch\PVSS_projects\TIP\TIP\panels\tip\tipFsm.pnl []
    Object: 0 named: "Tree_1" of type: TREE
    In reference: fwTreeDisplay\fwTree.pnl Group: 1 named: "PANEL_REF1"
      used in:    tip/tipFsmOperate.pnl Group: 18 named: "fsmOperate"
    Script: Initialize
    Library: \\cs-ccr-tip.cern.ch\PVSS_projects\TIP\installed_components\scripts\libs\fwFsmTreeDisplay.ctl
    Line: 1382, udata, 3
	Stacktrace:
	     1: fwFsmTree_getNodeLabel(string node = "&0001CV") at fwFsmTreeDisplay.ctl:1382
	     2: fwTreeDisplay_insertNode(string node_name = "CV", string parent = "fwSO_Infra ...", string node = "&0001CV") at fwTreeDisplay.ctl:726
	     3: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = "fwSO_Infra ...", string node = "&0001CV", int levels = 0, string sys = "", int exp = 0) at fwTreeDisplay.ctl:632
	     4: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = "FSM", string node = "fwSO_Infra ...", int levels = 1, string sys = "", int exp = 0) at fwTreeDisplay.ctl:688
	     5: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = "FSM", string node = "FSM", int levels = 2, string sys = "", int exp = 0) at fwTreeDisplay.ctl:688
	     6: fwTreeDisplay_redoTree(int treeIndex = 1, string currNode = "FSM") at fwTreeDisplay.ctl:520
	     7: main() at [Module: TIP_1;unicosGFPanel Panel: tip\tipFsm.pnl Object: Tree_1 Script: Initialize]:44


\A%{WCC_MANAGER:wcc_manager} *\(\d+\),%{SPACE}%{WCC_TIMESTAMP:wcc_timestamp},%{SPACE}%{WCC_ERRORTYPE:wcc_errortype},%{SPACE}*%{WCC_SEVERITY:wcc_severity},%{SPACE}*%{WCC_ERRORCODE:wcc_errorcode}(/\w+)?,%{SPACE}%{WCC_MESSAGE:wcc_message}(%{SPACE}{4}Module: %{WCC_ERR_MODULE:wcc_err_module})?(%{SPACE}{4}Panel: %{WCC_ERR_PANEL:wcc_err_panel})?(%{SPACE}{4}Object: %{WCC_ERR_OBJNUMB:wcc_err_obj_num} named: \"%{WCC_ERR_OBJNAME:wcc_err_obj_name}\" of type: %{WCC_ERR_OBJECT:wcc_err_obj})?(%{SPACE}{4}In reference: %{WCC_ERR_REFERS:wcc_err_refers} Group: %{WCC_ERR_REFGRP:wcc_err_refgrp} named: \"%{WCC_ERR_REFNAME:wcc_err_refname}\")?(%{SPACE}{6}used in:%{SPACE}*%{WCC_ERR_REFERS:wcc_use_in_refers} Group: %{WCC_ERR_REFGRP} named: \"%{WCC_ERR_REFNAME:wcc_used_in_ref_grp}\")?(%{SPACE}{4}Script: %{WCC_ERR_SCRIPT:wcc_err_script})?(%{SPACE}{4}(Library|In panel scope library): %{WCC_ERR_LIBRARY:wcc_library})?(%{SPACE}{4}Line: %{WCC_ERR_LINE:wcc_err_line}([,:] %{WCC_ERR_REASON:wcc_err_reason})?)?

WCC_MANAGER [\.\-\w]+
WCC_TIMESTAMP \d\d\d\d\.\d\d\.\d\d \d\d:\d\d:\d\d\.\d\d\d
WCC_ERRORTYPE \w+
WCC_SEVERITY INFO|WARNING|SEVERE|FATAL
WCC_ERRORCODE \d+
WCC_MESSAGE .*
WCC_MESSERR .*
WCC_ERR_MODULE .*
WCC_ERR_PANEL .*
WCC_ERR_OBJNUMB \d+
WCC_ERR_OBJNAME \w+
WCC_ERR_OBJECT \w+
WCC_ERR_REFERS [\\\.\-/\w]+
WCC_ERR_REFGRP \d+
WCC_ERR_REFNAME [ \.\-/\w]*
WCC_ERR_SCRIPT .*
WCC_ERR_LIBRARY .*
WCC_ERR_LINE \d+
WCC_ERR_REASON .+
WCC_DEBUGMSG \[(.*?\n)*.*?\]
WCC_LICREAL Hostname:.*\nHW-code:.*\nHW-version:.*
WCC_LICFILE ([ \w]{12}= .*\n){24,}.*
WCC_DBREPAIRLOG .*
WCC_UNPARSED \w(.*?\n)*.*
WCC_UNRECOGN (.*?\n)*.*
2

I get this output with logstash:

"wcc_manager" => "WCCOAui",
  "wcc_timestamp" => "2016.04.12 10:10:37.630",
  "wcc_errortype" => "CTRL",
   "wcc_severity" => "SEVERE",
  "wcc_errorcode" => "79",
    "wcc_message" => "Index out of range, \r\n    Module: TIP_1;unicosGFPanel\r\n    Panel: \\\\cs-ccr-tip.cern.ch\\PVSS_projects\\TIP\\TIP\\panels\\tip\\tipFsm.pnl []\r\n    Object: 0 named: \"Tree_1\" of type: TREE\r\n    In reference: fwTreeDisplay\\fwTree.pnl Group: 1 named: \"PANEL_REF1\"\r\n      used in:    tip/tipFsmOperate.pnl Group: 18 named: \"fsmOperate\"\r\n    Script: Initialize\r\n    Library: \\\\cs-ccr-tip.cern.ch\\PVSS_projects\\TIP\\installed_components\\scripts\\libs\\fwFsmTreeDisplay.ctl\r\n    Line: 1382, udata, 3\r\n\tStacktrace:\r\n\t     1: fwFsmTree_getNodeLabel(string node = \"&0001CV\") at fwFsmTreeDisplay.ctl:1382\r\n\t     2: fwTreeDisplay_insertNode(string node_name = \"CV\", string parent = \"fwSO_Infra ...\", string node = \"&0001CV\") at fwTreeDisplay.ctl:726\r\n\t     3: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = \"fwSO_Infra ...\", string node = \"&0001CV\", int levels = 0, string sys = \"\", int exp = 0) at fwTreeDisplay.ctl:632\r\n\t     4: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = \"FSM\", string node = \"fwSO_Infra ...\", int levels = 1, string sys = \"\", int exp = 0) at fwTreeDisplay.ctl:688\r\n\t     5: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = \"FSM\", string node = \"FSM\", int levels = 2, string sys = \"\", int exp = 0) at fwTreeDisplay.ctl:688\r\n\t     6: fwTreeDisplay_redoTree(int treeIndex = 1, string currNode = \"FSM\") at fwTreeDisplay.ctl:520\r\n\t     7: main() at [Module: TIP_1;unicosGFPanel Panel: tip\\tipFsm.pnl Object: Tree_1 Script: Initialize]:44\r"
3

grok doesn't like "\r\n"
So I invite you to replace this expression by a special pattern, like "````" for example.
And then you use grok