I've looked up on it a little.
Taking a better look, your events consist of date + user + json document.
There is a codec plugin that handles json inputs with newlines, the json_lines codec plugin.
However, your events are only partly json documents, so the codec would fail. This makes the solution a little bit, well, uglier. Maybe someone knows better (I'm a beginner at the ELK stack myself).
But this should work.
So, let's take this input:
This, while looks bad for the human eye, is quite standard format, so using the dissect filter should work, which is good because the dissect filter has a much lower performance need.
I added the date filter too, you'll probably need it anyway. I presume the dissect filter will eliminate the space between the date and the time.