Please go through the link below discuss the same problem
It is a long existing problem. As a workaround people used to use multiline filter and logs were getting parsed corrcetly. BUT now Multiline filter has been deprecated in favor of multiline-codec
Does anybody has any other workaround ? Last line of the logs is still not getting processed.