Filebeat 5.0 with multiline, split event data to two events