I have the following in my logstash pipeline (which receives multiline logs from Filebeat):
filter { if [type] == "oracle" { grok { mat