gistfile1.py

    multiline {                                                                                                                                                                                             
        tags => ["solr"]                                                                                                                                                                                    
        pattern => "^\s+"                                                                                                                                                                                   
        negate => false                                                                                                                                                                                     
        what => "previous"                                                                                                                                                                                  
    }                                                                                                                                                                                                       
                                                                                                                                                                                                            
    grep {                                                                                                                                                                                                  
        match => ["@message", "Exception"]                                                                                                                                                                  
        drop => false                                                                                                                                                                                       
        add_tag => ["exception","multiline"]                                                                                                                                                                
    }                                                                                                                                                                                                       
                                                                                                                                                                                                            
    grok {                                                                                                                                                                                                  
        patterns_dir => "./adslogging/logstash_patterns"                                                                                                                                                    
        tags => ["solr","exception"]                                                                                                                                                                        
        match => ["@message", "%{SOLREXCEPTION}"]                                                                                                                                                           
    }                                                                                                                                                                                                       

# in patterns file...
SOLRDATE %{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}                                                                                                                                        
SOLRLOG %{SOLRDATE:timestamp} %{LOGLEVEL:loglevel} %{NOTSPACE:class} %{WORD:method} (?:\[%{WORD:core}\] )%{GREEDYDATA:message}                                                                              
SOLREXCEPTION %{SOLRDATE:timestamp} %{LOGLEVEL:loglevel} %{NOTSPACE:class} %{WORD:method} %{GREEDYDATA:message}