ElasticSearch removing message after new line character

I am using Elasticsearch 5.3 with Filebeat to collect java system logs. I ship them directly to elasticsearch's ingest pipeline. I have filebeat set up to merge stacktraces into a single event, which I have verified is working correctly, however when I ship it to elastic, the message gets cut off after the first new line character. How can I resolve this?

Filebeat multiline processor:
multiline.pattern: '^['
multiline.negate: true
multiline.match: after

ElasticSearch pipeline:
"grok": {
"field": "message",
"patterns": [
"""%{GREEDYDATA:message}"""
]
}

For example, Filebeat will send this message:
[2017-04-12 19:02:44.990] [Emmas-MacBook-Pro.local] [main] ERROR o.s.boot.SpringApplication@reportFailure:839 - Application startup failed\norg.springframework.beans.factory.

And Elasticsearch will only save
"[2017-04-12 19:02:44.990] [Emmas-MacBook-Pro.local] [main] ERROR o.s.boot.SpringApplication@reportFailure:839 - Application startup failed"
In the message field

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.