Fix Catalina WARN and ERROR multiline grouping

I'm trying to set up LogStash at my institution and noticed weird grouping of the Catalina log events. Looks like WARN and ERROR are common beginning words that aren't in the multiline filter. Are there others?