Argh. It seems as if I can't select two solutions 
. This puts me in a difficult situation.
With apologies, I'm going to select my local colleague's solution, because it's a complete config that specifies lines as the input plugin, and cites that nice prebuilt Grok pattern.
Thanks again for your (valid) advice, much appreciated.