How is the message being shipped? If it’s filebeat, you can likely use the multi-line message feature to define beginning and end of each message - I am sure NXlog has something similar but I don’t use that. If you don’t have control on shipping, what input are you using? You could likely break that up with a pipeline rule.
The messages are not being shipped just yet, as I am still figuring that part out.
Given the constraints that I have (which I cannot disclose) Syslog is preferable, but if it has to be Filebeat then I’ll use that. I am open to suggestions or recommendations should you have other ideas