filebeat multiline

 

  multiline:
    pattern: '^\[\d+:\w+:\d+:\w+]'
    negate: true
    match: after