Really odd. I tried with just the 'nrpe' as you suggested above and still doesn't pull it out. So I commented out the multiline sections and it still doesn't strip it out. Not sure what is happening.
I only had the multiline in as that was the default config for syslog from the filebeat/logstash side.