logstash multiline

bacula.conf

input {
  file {
    path => [ '/home/jasper/bacula.log' ]
    type => "bacula"
	start_position => "beginning"
	codec => multiline {
		# Unless a line matches the regular bacula logformat, tag it onto the previous
		patterns_dir => '/usr/local/logstash/patterns'
		pattern => "(%{BACULA_INFO})|(%{BACULA_ERR})"
		negate  => true
		what    => "previous"
	}
  }
}

filter {
	if [type] == "bacula" {
		if "grokked" not in [tags] {
			grok {
				patterns_dir => '/usr/local/logstash/patterns'
				match => [ "message", "%{BACULA_MULTI}" ]
				add_tag => [ "grokked", "multi" ]
			}
		}

		if "grokked" not in [tags] {
			grok {
				patterns_dir => '/usr/local/logstash/patterns'
				match => [ "message", "%{BACULA_INFO}" ]
				add_tag => [ "grokked", "info" ]
			}
		}

		if "grokked" not in [tags] {
			grok {
				patterns_dir => '/usr/local/logstash/patterns'
				match => [ "message", "%{BACULA_STATUS}" ]
				add_tag => [ "grokked", "status" ]
			}
		}

		if "grokked" not in [tags] {
			grok {
				patterns_dir => '/usr/local/logstash/patterns'
				match        => [ "message", "%{BACULA_ERR}" ]
				add_tag      => [ "bacula_error", "grokked" ]
				remove_tag   => [ "_grokparsefailure" ]
			}
		}

		date {
			match => [ "timestamp", "dd-MMM HH:mm"]
			add_tag => [ "dated" ]
		}
	}
}

output {
  stdout { codec => rubydebug }
}

bacula.log

14-Nov 12:52 bacula-dir JobId 0: Fatal error: mysql.c:198 Unable to connect to MySQL server.
Database=bacula User=bacula
MySQL connect failed either server not running or your authorization is incorrect.
15-Dec 22:31 bacula-dir JobId 0: Using Catalog "MyCatalog"
05-Dec 11:53 bacula-dir: ERROR TERMINATION at bsys.c:556
bacula-dir is already running. pid=827
Check file /var/run/bacula-dir.9101.pid
05-Dec 11:53 bacula-dir: ERROR TERMINATION at bsys.c:556
bacula-dir is already running. pid=827
Check file /var/run/bacula-dir.9101.pid
15-Dec 22:31 bacula-dir JobId 0: Using Catalog "MyCatalog"
15-Dec 22:31 bacula-dir JobId 0: Using Catalog "bla"
15-Dec 22:31 bacula-dir JobId 0: Finished run:
  Storage: "bacula-storage" (/dev/backup)
  Job: "wubwubwub"

patterns

BJOB (?:\s+Job:\s+(?<jobname>%{GREEDYDATA}))
BSTORAGE (?:\s+Storage:\s+%{QS:device} \((%{PATH:mountpoint})\))
BPOOL (?:\s+Pool:\s+(%{GREEDYDATA:pool}))
BCLIENT (?:\s+Client:\s+%{QS:client}\s*(%{GREEDYDATA:version}))
BLEVEL (?:\s+Backup\ Level:\s+(%{GREEDYDATA:level}))
BFILESET (?:\s+FileSet:\s+%{QS:fileset})
BCATALOG (?:\s+Catalog:\s+%{QS:catalog})
BJOBSTATUS (?:\s+Termination:\s+%{GREEDYDATA:jobstatus})
BSDERRORS (?:\s+SD Errors:\s+%{NUMBER:sd_errors})
BTERMSTATUS (?:\s+(?<termination_daemon>(DIR|SD|FD))\ termination\ status:\s+%{GREEDYDATA:termination_status})
BKEY (?:\s+%{WORD:key}:\s+%{GREEDYDATA:value})*

BJOBID JobId %{NUMBER:jobid}
BTIMESTAMP ^(?<timestamp>%{MONTHDAY}-%{MONTH}\s+%{HOUR}:%{MINUTE})
BHOST %{HOSTNAME:hostname}-(?<daemon>(dir|sd|fd))

BACULA_INFO %{BTIMESTAMP} %{BHOST} %{BJOBID}: %{GREEDYDATA:bacula_message}[^\n]+
BACULA_MULTI %{BACULA_INFO}\n?%{GREEDYDATA:bacula_message}
BACULA_STATUS %{BACULA_INFO}\n?%{BSTORAGE}?\n?%{BJOB}?\n?%{BPOOL}?\n?%{BCLIENT}?\n?%{BLEVEL}?\n?%{BFILESET}?\n?%{BCATALOG}?\n?%{BJOBSTATUS}?\n?%{BSDERRORS}?\n?%{BTERMSTATUS}?\n?%{BKEY}?
BACULA_ERR %{BTIMESTAMP} %{BHOST}: %{GREEDYDATA:bacula_message}

BACULA (%{BACULA_STATUS}|%{BACULA_MULTI}|%{BACULA_INFO}|%{BACULA_ERR})

This incorrectly tags a message such as:

{
        "@timestamp" => "2014-11-14T11:52:00.000Z",
           "message" => "14-Nov 12:52 bacula-dir JobId 0: Fatal error: mysql.c:198 Unable to connect to MySQL server.\nDatabase=bacula User=bacula\nMySQL connect failed either serve
r not running or your authorization is incorrect.",
          "@version" => "1",
              "tags" => [
        [0] "multiline",
        [1] "grokked",
        [2] "status",
        [3] "dated"
    ],
              "type" => "bacula",
              "host" => "smoker.fritz.box",
              "path" => "/home/jasper/bacula.log",
         "timestamp" => "14-Nov 12:52",
          "hostname" => "bacula",
            "daemon" => "dir",
             "jobid" => "0",
    "bacula_message" => "Fatal error: mysql.c:198 Unable to connect to MySQL server.\nDatabase=bacula User=bacula\nMySQL connect failed either server not running or your authorizati
on is incorrect"
}

as "status", whereas it should just be "multi".

It also fails to expand the "mountpoint" and other fields in a real status message:

{
        "@timestamp" => "2014-12-15T21:31:00.000Z",
           "message" => "15-Dec 22:31 bacula-dir JobId 0: Finished run:\n  Storage: \"bacula-storage\" (/dev/backup)\n  Job: \"somethingsomethinginthemonthofmay\"",
          "@version" => "1",
              "tags" => [
        [0] "multiline",
        [1] "grokked",
        [2] "status",
        [3] "dated"
    ],
              "type" => "bacula",
              "host" => "smoker.fritz.box",
              "path" => "/home/jasper/bacula.log",
         "timestamp" => "15-Dec 22:31",
          "hostname" => "bacula",
            "daemon" => "dir",
             "jobid" => "0",
    "bacula_message" => "Finished run:\n  Storage: \"bacula-storage\" (/dev/backup)\n  Job: \"somethingsomethinginthemonthofmay"
}