Multiline logstash "next" not grouping - elasticsearch

Question

Short:
I am having troubles with multiline. I get the tag "multiline" on the log but it doesn't put them together.
Explanation:
Logs I receive
September 22nd 2016, 13:43:52.738 [0m[[31merror[0m] [0mTotal time: 368 s, completed 2016-09-22 13:43:52[0m
September 22nd 2016, 13:43:51.738 [0m[[0minfo[0m] [0m[36mSuites: completed 29, aborted 0[0m[0m
September 22nd 2016, 13:43:51.738 [0m[[31merror[0m] [0mFailed: Total 100,
Failed 4, Errors 0, Passed 96[0m
September 22nd 2016, 13:43:51.737 [0m[[0minfo[0m] [0m[36mRun completed in 1 minute, 24 seconds.[0m[0m
September 22nd 2016, 13:43:51.737 [0m[[0minfo[0m] [0mScalaTest[0m
The line with "Total time: %{NUMBER} s" is repeated multiple time and I'm only interested in these Total time coming after a "Total, Failed, Error" line.
Between the first and the second line could be none or several logs.
My configuration is:
grok {
#1
match => {"message" => "\[.m\[\u001b\[3.m%{NOTSPACE:level}\u001b\[0m\] \u001b\[0m%{NOTSPACE:Status}: Total %{NUMBER}, Failed %{NUMBER}, Errors %{NUMBER}$
add_tag => [ "test.continue" ]
tag_on_failure => []
}
#2
if "test.continue" in [tags]{
multiline {
pattern => "%{TIMESTAMP_ISO8601}\u001b\[0m$"
what => "next"
negate => true
}
}
#3
#OverallTime
grok {
match => {"message" => "\[.m\[\u001b\[3.m%{NOTSPACE:level}\u001b\[0m\] \u001b\[0mTotal time: %{NUMBER:Seconds:int} s, completed"}
add_tag => [ "test.overalltime" ]
tag_on_failure => []
}
What I get is:
beats_input_codec_plain_applied, test.continue, multiline [0m[[31merror[0m] [0mFailed: Total 100, Failed 4, Errors 0, Passed 96[0m
The first log gets the multiline tag and the test.continue but doesn't behave as I expect.
The logic as I understand it is:
If you find [0m[[31merror[0m] [0mFailed: Total 100, Failed 4, Errors 0, Passed 96[0m then put a tag "test.continue",
Multiline every log with the tag "test.continue" and send it to the next line you find until you find a log with the end %{TIMESTAMP_ISO8601}\u001b\[0m$
Extract the time from that log
More explanation:
I'm believing the behaviour will be, but is not happening.
1 finding the trigger
[0m[[31merror[0m] [0mFailed: Total 100,
Failed 4, Errors 0, Passed 96[0m
2 Once it finds it, it will take it and added at the beginning of the next line. Since the first part of the log will still match, it will add again the tag and then sends it to the multiline again
[0m[[31merror[0m] [0mFailed: Total 100,
Failed 4, Errors 0, Passed 96[0m [0m[[0minfo[0m] [0m[36mSuites: completed 29, aborted 0[0m[0m
3 It will have the first, second, ... , until it finds the log which finishes with a timestamp and breaks the multiline. The next log will be not added with the tag.
[0m[[31merror[0m] [0mFailed: Total 100, Failed 4, Errors 0, Passed 96[0m [0m[[0minfo[0m] [0m[36mSuites: completed 29, aborted 0[0m[0m [0m[[31merror[0m] [0mTotal time: 368 s, completed 2016-09-22 13:43:52[0m