How to parse WebSphere SystemErr log in logstash

IBM WebSphere logs include SystemOut and SystemErr logs for a JVM. Each message in SystemOut is enabled with timestamp that can be parsed with logstash. Exceptions in this log has stack trace but does not include timestamp in front so that they can be combined into one message. Sample of SystemOut.log:
// Sample code
</>
[02.10.2020 12:00:00:742 TRT] 000000bc SystemOut O Fri Oct 02 12:00:00 TRT 2020 : PusulaQuartzJobListener.END : AsynchronousInvocation(pusulaQueueJob.asyncScan())
[02.10.2020 12:01:26:224 TRT] 0000005f NGUtil$Server I ASND0002I: Detected server alfa102 started on node valyriaNode01
[02.10.2020 12:04:04:835 TRT] 000001c0 filter E com.ibm.ws.webcontainer.filter.FilterInstanceWrapper doFilter SRVE8109W: Uncaught exception thrown by filter Seam Filter: java.io.FileNotFoundException: SRVE0190E: File not found: /favicon.ico
at com.ibm.ws.webcontainer.extension.DefaultExtensionProcessor._processEDR(DefaultExtensionProcessor.java:976)
at com.ibm.ws.webcontainer.extension.DefaultExtensionProcessor.processEDR(DefaultExtensionProcessor.java:957)
at com.ibm.ws.webcontainer.extension.DefaultExtensionProcessor.handleRequest(DefaultExtensionProcessor.java:485)
at com.ibm.ws.webcontainer.filter.WebAppFilterChain.invokeTarget(WebAppFilterChain.java:136)
at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:97)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:83)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:73)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:73)
at org.jboss.seam.web.IdentityFilter.doFilter(IdentityFilter.java:40)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
at org.jboss.seam.web.MultipartFilter.doFilter(MultipartFilter.java:90)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:73)
at org.jboss.seam.web.RedirectFilter.doFilter(RedirectFilter.java:45)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:73)
at org.ajax4jsf.webapp.BaseXMLFilter.doXmlFilter(BaseXMLFilter.java:206)
at org.ajax4jsf.webapp.BaseFilter.handleRequest(BaseFilter.java:290)
at org.ajax4jsf.webapp.BaseFilter.processUploadsAndHandleRequest(BaseFilter.java:388)
at org.ajax4jsf.webapp.BaseFilter.doFilter(BaseFilter.java:515)
at org.jboss.seam.web.Ajax4jsfFilter.doFilter(Ajax4jsfFilter.java:56)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
at org.jboss.seam.web.LoggingFilter.doFilter(LoggingFilter.java:60)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
at org.jboss.seam.servlet.SeamFilter.doFilter(SeamFilter.java:158)
at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:195)
at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:91)
at org.jboss.seam.web.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:42)
</>
Up to here parsing is fine. But when it comes to SystemErr.log each message has timestamp in front even if the stack trace has timestamp. Sample for SystemErr.log:
Starting of an error message:
</>
[18.09.2020 08:49:07:557 TRT] 0000016a SystemErr R org.mozilla.javascript.WrappedException: Wrapped java.lang.NullPointerException (Komut[700988]#5)
[18.09.2020 08:49:07:558 TRT] 0000016a SystemErr R at org.mozilla.javascript.Context.throwAsScriptRuntimeEx(Context.java:1754)
[18.09.2020 08:49:07:558 TRT] 0000016a SystemErr R at org.mozilla.javascript.MemberBox.invoke(MemberBox.java:148)
[18.09.2020 08:49:07:558 TRT] 0000016a SystemErr R at org.mozilla.javascript.NativeJavaMethod.call(NativeJavaMethod.java:225)
[18.09.2020 08:49:07:559 TRT] 0000016a SystemErr R at org.mozilla.javascript.optimizer.OptRuntime.call1(OptRuntime.java:32)
[18.09.2020 08:49:07:559 TRT] 0000016a SystemErr R at org.mozilla.javascript.gen.Komut_700988__7._c_f_1(Komut[700988]:5)
[18.09.2020 08:49:07:559 TRT] 0000016a SystemErr R at org.mozilla.javascript.gen.Komut_700988__7.call(Komut[700988])
[18.09.2020 08:49:07:559 TRT] 0000016a SystemErr R at org.mozilla.javascript.optimizer.OptRuntime.callName0(OptRuntime.java:74)
[18.09.2020 08:49:07:559 TRT] 0000016a SystemErr R at org.mozilla.javascript.gen.Komut_700988__7._c_script_0(Komut[700988]:8)
[18.09.2020 08:49:07:559 TRT] 0000016a SystemErr R at org.mozilla.javascript.gen.Komut_700988__7.call(Komut[700988])
[18.09.2020 08:49:07:559 TRT] 0000016a SystemErr R at org.mozilla.javascript.ContextFactory.doTopCall(ContextFactory.java:394)
[18.09.2020 08:49:07:559 TRT] 0000016a SystemErr R at org.mozilla.javascript.ScriptRuntime.doTopCall(ScriptRuntime.java:3091)
[18.09.2020 08:49:07:559 TRT] 0000016a SystemErr R at org.mozilla.javascript.gen.Komut_700988__7.call(Komut[700988])
[18.09.2020 08:49:07:559 TRT] 0000016a SystemErr R at org.mozilla.javascript.gen.Komut_700988__7.exec(Komut[700988])
...
[18.09.2020 08:49:07:567 TRT] 0000016a SystemErr R Caused by: java.lang.NullPointerException
[18.09.2020 08:49:07:568 TRT] 0000016a SystemErr R at com.gunessigorta.pusula.uretim.UretimScriptBean.endeksliDovizCinsiniAyarla(UretimScriptBean.java:6007)
[18.09.2020 08:49:07:568 TRT] 0000016a SystemErr R at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
[18.09.2020 08:49:07:568 TRT] 0000016a SystemErr R at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:95)
[18.09.2020 08:49:07:568 TRT] 0000016a SystemErr R at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:56)
[18.09.2020 08:49:07:568 TRT] 0000016a SystemErr R at java.lang.reflect.Method.invoke(Method.java:620)
[18.09.2020 08:49:07:568 TRT] 0000016a SystemErr R at org.mozilla.javascript.MemberBox.invoke(MemberBox.java:126)
[18.09.2020 08:49:07:568 TRT] 0000016a SystemErr R ... 112 more
[18.09.2020 08:49:07:577 TRT] 0000016a SystemErr R com.filika.sigorta.exceptions.IceAktarimException: Döviz cinsi kontrolü@RISK_BILGILERI[282456].end.fail, Teklif SIGORTA_KONULARI kuralları çalıştırılırken hata oluştu!
</>
How can I combine the same threadID lines as one message if the message does not start with "at"? I could not find how to write this rule in logstash. Pseudo could is like this
If the log is SystemErr
if threadID is same
if message is not starting by at
starting a new message as msgReal
else message starts with at
append the message to msgReal
else
set as new msgReal

should parse the SystemErr but not sure how to implement it in logstash. I appreciate your help. Thanks.