Set multiline codec parameter 'what' to 'next'. The pattern (section z) marks the end of an event, not the beginning. Otherwise the section z of the previous event will be assigned to the current event.

Author: saknopper

1000_input_stdin_example.conf

@@ -6,7 +6,7 @@ input {
     codec => multiline {
       pattern => "^--[a-fA-F0-9]{8}-Z--$"
       negate => true
-      what => previous
+      what => next
     }
   }
 

1010_input_file_example.conf

@@ -14,7 +14,7 @@ input {
       charset => "US-ASCII"
       pattern => "^--[a-fA-F0-9]{8}-Z--$"
       negate => true
-      what => previous
+      what => next
     }
   }
 }