I'm currently running filebeat as a windows service. I haven't tried this yet, but I wonder if I defined multiple windows services, which each run an instance of filebeat with it's own .yml file. That way, each yml file could direct filebeat to a specific log with a specific multiline pattern for it.