What else is in the log file? I would expect there to be another ERROR message.
Your multiline configuration looks wrong to me. It will consume the first 4 lines as one event, then the first two event elements will be flushed as events, then the last two lines. How about
pattern => "</trouble_shooter_log>"
negate => true
what => next