I was researching and found I dont think this cannot be done by filebeat. Please see this post Filebeat multiline by Queue ID
Also, i found the below in the documentation,https://www.elastic.co/guide/en/logstash/current/multiline.html
If you are using a Logstash input plugin that supports multiple hosts, such as the beats input plugin, you should not use the multiline codec to handle multiline events. Doing so may result in the mixing of streams and corrupted event data. In this situation, you need to handle multiline events before sending the event data to Logstash.
If you think it logstash might pick up threads in disorder how can i make in order.