Logstash multiline codec plugin

Perhaps Logstash thinks it has already processed the file and is waiting for more input. Setting sincedb_path => "nul" in the file input will clear that.