I created this article 5 years ago about capturing information from multiple lines in LOG KM.
Hope you can find something helpful.
Understood what you are doing but this does not help me since is pulls the match strings.
BTW you do not have to have a notification server to use user defined. I do it all the time to add data to the patrol event.
I see your point here and thanks for the note on notification server. If you don't have any matching string to mark the beginning of the matching block, there are a couple of options:
1) Write a custom KM. I understand there is a lot of overhead involved including versioning, packaging, importing and downloading.
2) Develop a shell/powershell script to find the matching line# and extract the the previous 10 lines as the script output. Then use the 'script' option in LOG KM to generate events. This will save you from developing a custom KM. You do have to deploy your script to every PATROL agent server. I have an example of 'script' option in LOG KM here in my old blog:
Hope it helps,