Lumberjack input + grok and multiline


I have to combine logstash's lumberjack input, which in my case is the main shipper for all types of logs from centralized location to logstash and then I need to filter it with grok. So far so good - but the issue is that my logs are multiline.

I'm using the logstash filter Multiline and not the codec multiline as I have a single input of logs, and not all of my logs are multiline.

So my questions are:

  1. Can I have multime lumberjack inputs on the same port, with just separating by log type. At the moment my lumberjack input looks like this:

input {
lumberjack {
port => 5000
type => "logs"
ssl_certificate => "/etc/pki/tls/secure.crt"
ssl_key => "/etc/pki/tls/secure.key"
2. How to combine the grok and the multiline filter? So far I managed to get the multilines but I can not parse the message properly (by fields) - to every message I get _grokparsefailure.

My filter looks like this:
if [type] == "applog" {
multiline {
pattern => "^%{TIMESTAMP_ISO8601} "
negate => "true"
what => "previous"

grok {
	match => {
	"message" => [ "%{APPLOG}" ] # this is my custom log pattern which you can find below
date {
	match => ["apptimestamp","YYYY-MM-dd HH:mm:ss,SSS","ISO8601"]
	target => "@timestamp"
	locale => "en"


And %{APPLOG} equals to