diff --git a/knotctl/__init__.py b/knotctl/__init__.py
index 56ccc18..bfe66e6 100755
--- a/knotctl/__init__.py
+++ b/knotctl/__init__.py
@@ -99,21 +99,24 @@ def run_audit(url: str, jsonout: bool, headers: dict):
             )
             # Simple case, just one line with timestamp
             if cur_has_timestamp and next_has_timestamp:
-                text = ":". join(line.split(':')[1:])
                 timestamp = line.split(']')[0].split('[')[1]
+                text = line.split(']')[1].lstrip(':').strip()
                 out.append({'timestamp': timestamp, 'text': text})
                 text = ""
                 timestamp = ""
+            # Start of multiline
             elif cur_has_timestamp:
                 timestamp = line.split(']')[0].split('[')[1]
-                text = ":". join(line.split(':')[1:])
+                text = line.split(']')[1].lstrip(':').strip()
+            # End of multiline
             elif next_has_timestamp:
-                text += f'\n{line}'
+                text += f'\n{line.strip()}'
                 out.append({'timestamp': timestamp, 'text': text})
                 text = ""
                 timestamp = ""
+            # Middle of multiline
             else:
-                text += f'\n{line}'
+                text += f'\n{line.strip()}'
 
     else:
         out = string