Example of Multiple Grok Patterns in Logstash.conf

gistfile1.txt

# NOTE: I don't think this is documented behaviour. I've used this output format in production on multiple servers for some time with no issues, but please test thoroughly!!!! And don't read too much into the patterns: dummies for this example

input {
    file {
        path => "/tmp/tasks.log"
        start_position => end
        sincedb_path => "/tmp/"
    }
}
filter {
    date {
        match => [ "timestamp" , "yyyy/MM/dd HH:mm:ss" ]
    }
    grok {
        patterns_dir => "/home/web/workers/resources/patterns/"
        match => { 
            message => [
                "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND} - (?<LOG_LEVEL>[a-zA-Z]+) - USER: (?<USER>[_a-zA-Z0-9\-]+) (?<message>[\s\S]+)",
                "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND} - (?<LOG_LEVEL>[a-zA-Z]+) - (?<TASK_NAME>[a-zA-Z_]+) - (?<LINE_NO>[\d]+) - (?<message>[\s\S]+)",
                "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND} - (?<LOG_LEVEL>[a-zA-Z]+) - (?<USER_ID>[\d]+) - (?<LINE_NO>[\d]+) - (?<message>[\s\S]+)",
                "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND} - (?<LOG_LEVEL>[a-zA-Z]+) - (?<PUBLISHER>[\w]+) - (?<LINE_NO>[\d]+) - (?<message>[\s\S]+)",
            ]
        }
    }
}

output {
    ...
}