Grok config for Magento exception.log

logstash.conf

input {
  file {
    path => "/path/to/exception.log"
    type => "magento_exception"
    codec => multiline {
      pattern => "^%{TIMESTAMP_ISO8601}"
      negate => true
      what => "previous"
    }
  }
}


filter {
  if [type] == "magento_exception" {
    grok {
      match => { "message" => "(?m)%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{WORD}%{SPACE}\(%{INT}\):(%{SPACE})?\n%{GREEDYDATA:remaining_message}" }
    }
    date {
      match => [ "timestamp", "ISO8601" ]
      remove_field => [ "timestamp" ]
    }
    mutate {
      rename => { "remaining_message" => "message" }
    }
    split {
      terminator => "Next "
    }
    if !("_grokparsefailure" in [tags]) {
      grok {
        match => { "message" => "(?m)exception %{QUOTEDSTRING:exception} with message %{DATA:exception_detail} in %{PATH:exception_file}\n%{GREEDYDATA:stack_trace}" }
      }
      mutate {
        gsub => [
          "exception", "'", "",
          "exception_detail", "'", ""
        ]
      }
    }
  }
}
output { stdout { codec => rubydebug } }