codec => multiline { pattern => " NFO\|" what => "previous" negate => true auto_flush_interval => 2 }
Once you have gotten the date, hostname, application you can then remove them using
mutate { gsub => [ "message", "^[A-Za-z]{3}\s[0-9]{1,2} [0-9]{2}:[0-9]{2}:[0-9]{2} [a-zA-Z]+ [a-zA-Z]+: ", "" ] }
Which will leave you with
"message" => "NFO|HTTP |HTTP PACKET TO 127.0.0.1:port FROM 127.0.0.1:port\nHTTP/1.0 200 OK\nDate: Wed, 13 Mar 2019 12:40:02 GMT\ncontent-length: 2049\ncontent-type: text/plain; charset=UTF-8"