After your guidance,
I did this in filebeat.yml file and changed the filebeat.prospectors
multiline:
pattern: '^%{WORD:}(%{NONNEGINT:}) captured on %{GREEDYDATA:}'
negate: true
match: after
but i don't know how to make same pattern in filebeat as i read here : Filebeat multiline codec not working in my case
"filebeat multiline pattern is not grok pattern as in logstash, but pure regular expressions."
Can you help me to convert this logstash pattern in filebeat pattern or regex format ?
Thanks