grok {
match => [ "message", "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:logsource} %{SYSLOGPROG}: \[%{INT:line}-%{INT:part_of_line}\] %{GREEDYDATA:ostatok}" ]
}

aggregate {
task_id => "%{line}%{pid}"
code => "
map.merge!(event) if map.empty?
map['full_message'] ||= ''
map['full_message'] += event['ostatok']
"
timeout => 10
push_map_as_event_on_timeout => true
timeout_code => "event.tag('aggregated')"
}

if "aggregated" not in [tags] {
drop {}
}