Thank you Shaunak. I tried excluding and including\n+^EventKOK:On both cases, filebeat consider it as two different events and raised parsing error for the part starting EventKOK: id = ResourceStatus-kk0000_opiii-2020-08-03T02-39-52Z description = Resource Update Event type = Comment start = Aug 3, 2020 2:39:52 AM [965270392 0 [2020/08/03 02:39:52.000]] stop = Aug 3, 2020 2:39:52 AM [965270392 0 [2020/08/03 02:39:52.000]] resource names = [kk0000_opiii] params = Name: Status Value: OK The whole event, starting with timestamp 03 Aug 2020 02:39:53,456 to the last line, .Name: Status Value: OK should be in one event.