Two problems:
- Your pattern is not a regular expression. It looks like the pattern used for a date filter. Use your grok expression as a starting point instead.
- The logic is flawed since it'll only work for sequences of two lines. If you have a sequence of three lines that should be joined, the second line won't begin with a timestamp so it won't be joined with the following line. Instead, turn the logic around with
negate => trueand usewhat => "previous", expressing "if the line doesn't begin with a timestamp, join it with the preceding line".