[PARSER]
   Name        json
   Format      json

[MULTILINE_PARSER]
   name          multiline-json-regex
   key_content   message
   type          regex
   parser        json
   flush_timeout 2000

   #
   # Regex rules for multiline parsing
   # ---------------------------------
   #
   # configuration hints:
   #
   #  - first state always has the name: start_state
   #  - every field in the rule must be inside double quotes
   #
   # rules |   state name  | regex pattern                  | next state
   # ------|---------------|--------------------------------------------
   rule      "start_state"   "/(Dec \d+ \d+\:\d+\:\d+)(.*)/"  "cont"
   rule      "cont"          "/^\s+at.*/"                     "cont"