Logstash Tomcat logs - elasticsearch

Question

I would like to Parse tomcat logs where we have soap/rest request and response. can any one give me any good example where we can parse those logs and save it in elastic search in json format.

Answer 1

filter {
if [type] == "tomcatlog"{
multiline {
#type => "all" # no type means for all inputs
pattern => "^%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
}
grok {
match => {
message => "%{TIMESTAMP_ISO8601:timestamp}%{SPACE}\{(?<thread>[^)]+)\}%{SPACE}%{LOGLEVEL:level}%{SPACE}\[(?<logger>[^\]]+)\]%{SPACE}%{SPACE}%{GREEDYDATA:message}"
}
}
date {
match => [ "timestamp", "yyyy-MM-dd HH:mm:ss,SSS" ]
remove_field => [ "timestamp" ]
}
}
}
Use http://grokdebug.herokuapp.com/ to create grok filters. Useful pattern are listed patterns

Answer 2

Thanks Allen for your response. Here is my example which I am trying to parse using Grok Pattern. I am new to this one so trying to figure it out whether this one is right approach or not.
2015-09-28 10:50:30,249 {http-apr-8080-exec-4} INFO [org.apache.cxf.services.interfaceType] 1.0.0-LOCAL - Inbound Message
ID: 1
Address: http://localhost:8080/interface/interface?wsdl
Encoding: UTF-8
Http-Method: POST
Content-Type: text/xml; charset=UTF-8
Headers: {Accept=[/], cache-control=[no-cache], connection=[keep-alive], Content-Length=[2871], content-type=[text/xml; charset=UTF-8], host=[localhost:8080], pragma=[no-cache], SOAPAction=["http://services.localhost.com/calculate"], user-agent=[Apache CXF 2.7.5]}
Payload: users_19911111test123456false