How to properly configure fluentd for multiline log4j logs

I’m using Splunk Connect to forward logs from containers stdout to splunk, it seems to be using fluentd under the hood.

My containers output log4j formatted logs using this pattern

%d{yyyy-MM-dd'T'HH:mm:ss.SSSZZ} level=%p thread=%t logger=%c mdc=%X{mdc} %n%m%n

Which would output logs like this

2021-08-27T10:59:01.072-0700 level=INFO thread="mythread" logger=mylogger mdc="mymdc"
this is a message logged.

To deploy splunk connect daemonset, I use following configuration

global:
  splunk:
    hec:
      host: ${hostname}
      port: 8088
      token: ${token}
      protocol: https
      indexName: ${index}
      insecureSSL: true

splunk-kubernetes-logging:
  enabled: true
  containers:
    logFormat: '%Y-%m-%dT%H:%M:%S.%N%:z'
    logFormatType: cri

splunk-kubernetes-objects:
  enabled: false
splunk-kubernetes-metrics:
  enabled: false
EOF

When I look at the logs in Splunk i don’t see the logs message (which is in the second line of the logs). The fluentd question is what is the proper CRI format I should be using so fluentd can parse those logs?