I would do something very similar to the solution I proposed for the other format you had...
if [message] =~ /^(\s*$|:::::)/ {
drop {}
} else if [message] =~ /^TIME/ {
# parse it and stash it in a ruby class variable
} else if [message] =~ " .* .* " {
csv {separator => " " autodetect_column_names => true }
# and append the metadata
} else {
drop {}
}