How do I match a newline in grok/logstash?

All GREEDYDATA is is .*, but . doesn’t match newline, so you can replace %{GREEDYDATA:message} with (?<message>(.|\r|\n)*)and get it to be truly greedy.