I guess I have a solution.
I don't have to detect the last line. Seems for me, that filebeat detects it itself. Only have to be sure to start at first line and put everything on it.
filebeat.yml
filebeat.prospectors:
- input_type: log
paths:
- /X/Y/*/*
multiline.pattern: ' \A.*'
multiline.negate: true
multiline.match: after
tags: ["my-tag"]