Presently multi-line scanning is very processor intensive. I think this is because we are trying to do a single regex using the multi-line modifier across the entire log. Given that log files, unlike human written text only break lines in usually known locations, almost all places where a multi-line scan is needed, we know already where the line breaks will be. Because of this, a different, faster approach may be possible.

Instead of using a single multi-line regex, we can scan for multiple single line regexes that are expected to appear in order. So we perform the first single line scan, if we get a hit, starting with that line we continue to scan the file for the next pattern and so on, if we get to the end of the file w/o finding the last pattern, we have no match.

Does this make sense? Seems it should be no slower that the current single line scan.