Thank you very much for your help, it's really nice anyway !
To answer your two questions:
1/ It's a bit more complicated than that actually. I can't actually disable my ingest pipeline as it is currently in use and functional for other apps. In fact everything started because I wanted to optimize the way I managed the multiline in the filebeat.
On the other applications, the negate variable is false, and therefore my pattern is reversed, I will try to match with the different extralines. But knowing that they are all very different, it's complicated to manage and I wanted to do the opposite for this new application.
2/ Indeed, I hadn't paid attention but it is not integrated, and contrary to the multiline logs where I see in the filebeat logs that grok rejects them, in the case of a single line, I didn't see no message on filebeat...