I received windows events from another source in this format:
EventCode=1234 EvenType= blah blah User=me Message= key1:value1 arbitrarty ....
Each event entry that comes into log stash has a newline. I just want to concatenate together to become like this:
in one line.
How can I craft my filter to do this? Is it through a multiline input filter?