title: Parse multiline log entries using a regex
body: <p>I'm trying to parse log entries in a C# app using this regex: <code>(^[0-9]{4}(-[0-9]{2}){2}([^|]+\|){3})(?!\1)</code> for logs in a format like <em>[date (in some format)]</em> | <em>[level]</em> | <em>[appname]</em> | <em>[message]</em>.</p>
  
  <p>Where (I think):  </p>
  
  <ul>
  <li><code>^</code> matches the begin of a line (enabled <em>/gm</em> on regex101)</li>
  <li><code>[0-9]{4}(-[0-9]{2}){2}</code> followed by the begin of the date like 2015-03-03</li>
  <li><code>([^|]+\|){3})</code> followed by the rest of the date, the log level and app name  </li>
  <li><code>(?!\1)</code> followed by <strong>not</strong> the start of a new log entry (should be the message)  </li>
  </ul>
  
  <p>For example, I have the following <strong>4</strong> log entries (separated by a newline for clarification):</p>
  
  <pre>
  2015-03-03 19:30:47.2725|INFO|MyApp|This is a single line log message.
  
  2015-03-03 19:31:29.1209|INFO|MyApp|This log message has multiple
  lines with
  2015-03-03
  a date in it.
  
  2015-03-03 19:32:50.1106|INFO|MyApp|This log message has
  multiple lines
  but just text only.
  
  2015-03-03 19:33:20.2683|ERROR|MyApp|This log message has multiple lines but
  also some confusing text like
  2015-03-03 19:33:20.2683|ERROR| which should
  still be a valid log message.
  </pre>
  
  <p>But the regex does not capture the message when I test it on <a href="https://regex101.com" rel="nofollow">regex101</a>, probably because I don't understand how to capture the negative lookahead.</p>
  
  <p>If I include <code>.*</code> in the regex:
  <code>(^[0-9]{4}(-[0-9]{2}){2}([^|]+\|){3}).*(?!\1)</code> it matches the message but only a single line (because <code>.</code> does not match a newline).</p>
  
  <p>So how can I capture the (multiline) message?</p>