Like I said, maybe I have misunderstood the appropriate solution to my problem, given that the multiline examples don't deal with HTTP input. But nevertheless, I want to capture fatal ruby events in one log message, despite the fact that each line of these multiline errors is parsed as its own event (albeit with the same timestamp), e.g.:
"log" => "F, [2018-04-23T21:16:58.210343 #18212] FATAL -- : \n",
"log" => "NoMethodError (undefined method `downcase' for nil:NilClass):\n",
"log" => " app/models/activity_stream.rb:147:in `icon'\n",
"log" => " app/controllers/users/activity_streams_controller.rb:14:in `index'\n",
"log" => "\n",
"log" => "\n",
Logically these are one event, and I want them to come out of logstash this way. Is this possible? Perhaps a clever use of the aggregate filter?