You might have the same problem that I have : Combining the lines will not produce what you expect.
My post.
I posted the question today, but I'm still trying to figure it by myself or waiting for a miracle 
By the way, you will easily find what you need to determine the pattern for the multiline codec on that page :
Github-grok patterns