-

filter {
  if [type] == 'php-fpm-slow-log' {
     # Drop empty lines
     if [message] =~ /^\s*$/ {
         drop { }
     }

     # Time prefix appears on each line
     multiline {
         pattern => "^(\[0x0|script_filename|$)"
         what    => "previous"
     }

     grok {
         patterns_dir => "/etc/logstash/patterns/"
         match => [ "message", "(?m)%{PHP_FPM_SLOW_LOG}" ]
     }

     date {
         match        => [ "timestamp" , "dd-MMM-yyyy HH:mm:ss" ]
         target       => "@timestamp"
         remove_field => "timestamp"
     }
  }
}