Focusing just on the line breaking-try the following adjustments..
SHOULD_LINEMERGE = false
LINE_BREAKER =([\r\n]+)\w+\s+\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\,\d{3}
The characters you specify within the line breaker's capture group (when line merge is set to false) will, as you discovered, be deleted from the indexed event. To account for this, place the carriage return/new line within the capture group, and a positive lookahead of something consistently defining the start point of your event. It looks like in your case, a word, followed by a number of spaces, followed by your timestamp.
Setting line merge to false should prove to be more efficient.
I would also advise against setting truncate to 0. If your application suddenly begins spewing garbage data, splunk will not truncate the event and will happily continue it's indexing duties.
... View more