Multiline conf file to parse log file to elasticsearch

Elastic Stack Logstash
2

With

multiline {
  pattern => "^."
  negate => true
  what => "previous"
}

it looks like you're trying to join a line with its predecessor unless the line it blank, correct? Are there actually empty lines between each entry? Your example only contains a single entry with no terminating blank line.

Secondly, if this is the last entry in a file it's hard for Logstash to know if it has seen all of the message and should ship what it has collected. See LOGSTASH-512.

Finally, make sure New to logstash: file input and stdout output not working doesn't apply in your case.