Before you worry about the filters, you should fix your input so that it correctly assembles events. The log you show has the timestamp on the line after the JSON. So your multiline codec configuration should have negate => false.
If you use negate => true then the first line of the log (the JSON) will appear in a separate event, which will massively confuse you as you try to debug the configuration.
Once you are assembling events correctly I would recommend you start with a dissect filter to break out the JSON from the timestamp, log level, etc. Then a json filter to parse the JSON.