input { stdin { codec => multiline { pattern => "^\[" negate => true what => "previous" } } } multiline { pattern => "(^\d+\serror)|(^.+Exception:.+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Causedby:.+)" what => "previous" }