I have three multiline filter and they work fine. I test it with 4 "blocks" of logs. The last block don't reach elasticsearch, only if I'll shutdown logstash. I think the last block is waiting for another event. It's ok but in production i see a problem, what if logstash didn't get for hours not another event?! Is there a way to set a timeout for multiline?
Any ideas? Thanks for your help!