I would use a ruby filter to scan that.
ruby {
code => "
s = event.get('message')
r = s.scan(/Beginning ([^[:space:]]+) Job/)
r = r.flatten
event.set('jobs', r.join(','))
"
}
You might then want to mutate+split the jobs field.