Docker syslog driver with multiline parsing in logstash
Ok, I got this to work by using the logstash codec multiline with adding another filter after the grok match
mutate { gsub => [ "message", "<\d*>[\s\S]*?\[\d*\]:.", " " ] }