the mix of pattern, negate and flush_pattern might be the problem.
e.g. see sample without flush_pattern: https://play.golang.org/p/xcdssBnP8A
I did set negate: true, pattern: '^$'.
You have one email per file?
You plan to index the body, or do you just want to extract the header? Filebeat has no state-machine/parser + will continue processing until end of file. If al you want is the header, use include_lines (also a regex), to match for typical content in your headers.