input { file { path => "/logs/log-generator*.log" exclude => "*.gz" start_position => "beginning" sincedb_path => "/logs/log-generator.sincedb" codec => multiline { pattern => "^(DEBUG|INFO|ERROR|TRACE|FATAL|WARN).*" negate => "true" what => "previous" } } } output { stdout { # codec => json_lines } }